Export limit exceeded: 13055 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (13055 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-40375 | 1 Microsoft | 6 Dynamics 365 Business Central 2023 Wave 2, Dynamics 365 Business Central 2024, Dynamics 365 Business Central 2024 Wave 1 and 3 more | 2026-08-17 | 6.5 Medium |
| Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-61936 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-08-17 | 5.5 Medium |
| Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-66799 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-08-17 | 7.8 High |
| Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-49989 | 1 Cratedb | 1 Cratedb | 2026-08-17 | N/A |
| CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of `GRANT`s. CrateDB has two ways to access blob storage: SQL (`SELECT ... FROM blob.<table>` and friends) and the blob HTTP API (`GET|PUT|DELETE /_blobs/{table}/{digest}`). The SQL path goes through `AccessControl`, which is what enforces privilege grants; that's why `SELECT digest FROM blob.secret_blobs` fails for a user who has no grants on the table. The HTTP path authenticates the request but never asks `AccessControl` whether the authenticated user is allowed to touch the table. So a user with no grants gets `MissingPrivilegeException` from SQL and `200 OK` plus the blob bytes from `GET /_blobs/secret_blobs/<digest>`. Deployments that don't use `BLOB TABLE` are unaffected. Authentication itself still works; the bug is strictly that being authenticated as anyone is treated as sufficient for any blob op. Versions 6.2.8 and 6.3.2 fix the issue. | ||||
| CVE-2026-19598 | 2 Sc0ttkclark, Wordpress | 2 Pods – Custom Content Types And Fields, Wordpress | 2026-08-17 | 9.8 Critical |
| The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action. | ||||
| CVE-2026-73059 | 1 Stoatchat | 1 Stoatchat | 2026-08-16 | 6.5 Medium |
| stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes. | ||||
| CVE-2026-8840 | 2 Wordpress, Wpdevart | 2 Wordpress, Booking Calendar, Appointment Booking System | 2026-08-15 | 5.3 Medium |
| The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional booking emails by writing attacker-supplied payment status and transaction data directly into the payments table. The auto-approval of reservations is only triggered when the 'enable_psuccess_approval' site option is enabled, but payment status manipulation and email dispatch are exploitable regardless of that setting. | ||||
| CVE-2026-73607 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester. | ||||
| CVE-2026-73603 | 1 Flowiseai | 1 Flowise | 2026-08-14 | N/A |
| Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account. | ||||
| CVE-2026-73499 | 1 Etcd | 1 Etcd | 2026-08-14 | 6.5 Medium |
| etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1. | ||||
| CVE-2026-47718 | 1 Frangoteam | 1 Fuxa | 2026-08-14 | N/A |
| FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue. | ||||
| CVE-2026-72789 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 8.6 High |
| SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material. | ||||
| CVE-2026-16772 | 1 Akaunting | 1 Akaunting | 2026-08-14 | 8.1 High |
| In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes user-supplied role assignments via an unconditional `roles()->sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by this issue. | ||||
| CVE-2026-55987 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 8.1 High |
| OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | ||||
| CVE-2026-58438 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.5 High |
| Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access | ||||
| CVE-2026-73609 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents. | ||||
| CVE-2026-73605 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on the host, enabling reconnaissance of the filesystem layout and installed software. | ||||
| CVE-2026-72799 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 5.8 Medium |
| SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath). In publish mode, when Publish.Auth.Enable is false, an unauthenticated (anonymous) reader — or any publish reader token — can call these endpoints to enumerate the complete private document tree, mapping notebook names, folder hierarchies, and document titles, and resolving title paths to document IDs, including for documents marked hidden, password-protected, or publish-forbidden. | ||||
| CVE-2026-53786 | 2 Rsync Project, Samba | 2 Rsync, Rsync | 2026-08-14 | 6.5 Medium |
| rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude. | ||||
| CVE-2026-57886 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 5.9 Medium |
| Cross-repository issue/comment attachment re-linking can expose private attachment content | ||||