Export limit exceeded: 14985 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (14985 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-105687 | 1 Penpot | 1 Penpot | 2026-10-06 | 4.9 Medium |
| Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock the owner out of the team and its projects, files, fonts, and media. This issue is fixed in version 2.18.0. | ||||
| CVE-2026-105706 | 1 Sourcecodester | 1 Drug Recommendation System | 2026-10-06 | 4.3 Medium |
| A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-105693 | 1 Penpot | 1 Penpot | 2026-10-06 | 5.3 Medium |
| Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, page scopes, comment permissions, and inspection permissions, then replay a more permissive token to access page data that was not included in the original share. This issue is fixed in version 2.18.0. | ||||
| CVE-2025-62973 | 2 Themekraft, Wordpress | 2 Buddyforms, Wordpress | 2026-10-06 | 5.3 Medium |
| Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2. | ||||
| CVE-2026-97309 | 2026-10-06 | N/A | ||
| Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226. | ||||
| CVE-2026-97303 | 2026-10-06 | 7.6 High | ||
| Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2. | ||||
| CVE-2026-39789 | 2026-10-06 | 7.5 High | ||
| Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions. | ||||
| CVE-2026-39751 | 2026-10-06 | 7.5 High | ||
| Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions. | ||||
| CVE-2026-39749 | 2026-10-06 | 6.5 Medium | ||
| Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions. | ||||
| CVE-2026-39599 | 2026-10-06 | 4.3 Medium | ||
| Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions. | ||||
| CVE-2026-32578 | 2026-10-06 | 7.1 High | ||
| Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions. | ||||
| CVE-2026-25433 | 2026-10-06 | 7.1 High | ||
| Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions. | ||||
| CVE-2026-105072 | 2026-10-06 | 7.5 High | ||
| Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions. | ||||
| CVE-2026-104386 | 2026-10-06 | 6.5 Medium | ||
| Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3. | ||||
| CVE-2026-103337 | 2026-10-06 | 6.5 Medium | ||
| Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2. | ||||
| CVE-2026-103086 | 2026-10-06 | 6.5 Medium | ||
| Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74. | ||||
| CVE-2026-105703 | 1 Phpgurukul | 2 User Registration & Login And User Management System, User Registration Login And User Management System | 2026-10-06 | 4.7 Medium |
| A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-103762 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-10-06 | 5.3 Medium |
| SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time. | ||||
| CVE-2026-105684 | 1 Penpot | 1 Penpot | 2026-10-05 | 4.3 Medium |
| Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threads and full comment bodies from other pages in the same file, including commenter names, email addresses, photos, and page identifiers. The disclosed page identifiers can also be used with affected page-reading functionality to access unshared design content. This issue is fixed in version 2.18.0. | ||||
| CVE-2026-105695 | 1 Penpot | 1 Penpot | 2026-10-05 | 5.9 Medium |
| Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed upload-session UUID can assemble the victim's chunks into the attacker's own file, team font, or project import, disclosing the uploaded bytes and deleting the victim's pending session. This issue is fixed in version 2.18.0. | ||||