Export limit exceeded: 11230 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11230 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108652 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an attacker-controlled image URL, to replace administrators' avatars. | ||||
| CVE-2026-108647 | 2 Jeecg, Jeecgboot | 3 Jeecg-boot, Jeecg Boot, Jeecgboot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and bulk-create system-wide encoding validation rules with arbitrary regular expression patterns. | ||||
| CVE-2026-108637 | 2 Jeecg, Jeecgboot | 3 Jeecg-boot, Jeecg Boot, Jeecgboot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant checks, tampering with administrator-maintained groups. | ||||
| CVE-2026-108632 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to retrieve depart_id, permission_id and data_rule_ids for any department. | ||||
| CVE-2026-108627 | 1 Jeecg | 2 Jeecg-boot, Jeecg Boot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound rule ids for any role. | ||||
| CVE-2026-108622 | 2 Jeecg, Jeecgboot | 3 Jeecg-boot, Jeecg Boot, Jeecgboot | 2026-10-18 | 5.4 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen sys_log records to erase traces of their actions. | ||||
| CVE-2026-108617 | 2 Jeecg, Jeecgboot | 2 Jeecg Boot, Jeecgboot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes and content into the shared sys_sms_template library used for system, e-mail, SMS and IM notifications. | ||||
| CVE-2026-108612 | 1 Jeecg | 2 Jeecg-boot, Jeecg Boot | 2026-10-18 | 5.4 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to permanently delete any templates in the shared library. | ||||
| CVE-2026-108581 | 1 Tencentcloud | 1 Octop | 2026-10-18 | 6.5 Medium |
| TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts. | ||||
| CVE-2026-108165 | 1 Futo | 1 Immich | 2026-10-18 | 4.3 Medium |
| Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details. | ||||
| CVE-2026-107763 | 2026-10-18 | 4.3 Medium | ||
| The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file. | ||||
| CVE-2026-107744 | 2 Thimpress, Wordpress-extensions | 2 Learnpress, Learnpress | 2026-10-18 | 6.5 Medium |
| The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns. | ||||
| CVE-2026-83658 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-18 | 5.5 Medium |
| Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83568 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-10-18 | 7.8 High |
| Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83583 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-18 | 7.8 High |
| Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-74034 | 1 Wazuh | 2 Wazuh, Wazuh-manager | 2026-10-18 | 7.5 High |
| Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys. | ||||
| CVE-2026-75505 | 1 Espocrm | 1 Espocrm | 2026-10-18 | N/A |
| EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 10.0.2. | ||||
| CVE-2026-69905 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-18 | 5.5 Medium |
| Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-111916 | 1 Admidio | 1 Admidio | 2026-10-17 | 5.3 Medium |
| Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories. | ||||
| CVE-2026-63174 | 1 Omnispace | 1 Agora Project | 2026-10-17 | 8.1 High |
| Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces. | ||||