Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,983

Export CSV
CVE-2026-110218

Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Aureus Erp
CVE-2026-106612

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Coldfusion Coldfusion 2023 Coldfusion 2025
CVE-2026-106098

WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Data Access
CVE-2026-109119

Missing Authorization in rdiffweb

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2026-108388

Indico legacy contribution export cache poisoning discloses restricted metadata

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Indico
Products
Indico
CVE-2026-107795

Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API

Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations.  Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Software Controller
CVE-2026-110211

SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint

iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Iflytek
Products
Skillhub
CVE-2026-110216

youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Youlai
Products
Youlai-boot
CVE-2026-106090

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Coldfusion Coldfusion 2023 Coldfusion 2025
CVE-2026-106614

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Coldfusion Coldfusion 2023 Coldfusion 2025
CVE-2026-110112

Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation

Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Finsys
Products
Dockhand
CVE-2026-85990

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Leantime
Products
Leantime
CVE-2026-110123

Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints

Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Maku
Products
Maku-boot
CVE-2026-77361

obsidian-tc symlink path mismatch bypasses read ACL restrictions

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied folder can therefore bypass the read ACL and expose files in the denied folder. Exploitation requires an out-of-band-planted symlink and does not permit an escape from the vault root. Version 1.3.1 fixes the vulnerability by applying ACL checks to the resolved vault-relative path.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
The-40-thieves
Products
Obsidian-tc
CVE-2026-111646

SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Surveyking
Products
Surveyking
CVE-2026-111631

Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-88755

Zai ZCode RCE via Automatic MCP Server Connection

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-111688

Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Exrick
Products
Xboot