Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,112

Export CSV
CVE-2026-25565

WeKan < 8.19 Read-only Board Roles Can Update Cards

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission. This can allow users with read-only roles to perform card updates that should require write access.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wekan Project
Products
Wekan
CVE-2026-28227

Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the `publish_to_category` topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

CVSS 4.0 · 1.2 Low EPSS 3.2% KEV · Not listed
Vendors
Discourse
Products
Discourse
CVE-2026-25741

Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users

Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session during an upgrade flow was accessible to users with only organization member privileges. When the associated Stripe Checkout session is completed, the Stripe webhook updates the organization’s default payment method. Because no billing-specific authorization check is enforced, a regular (non-billing) member can change the organization’s payment method. This vulnerability affected the Zulip Cloud payment processing system, and has been patched as of commit bf28c82dc9b1f630fa8e9106358771b20a0040f7. Self-hosted deploys are no longer affected and no patch or upgrade is required for them.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Zulip
Products
Zulip
CVE-2026-28354

ClipBucket v5 has IDOR in Collection Item Management

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing a normal authenticated user to modify another user’s collection items. This affects both add item (/actions/add_to_collection.php) due to missing authorization checks and delete item (/manage_collections.php?mode=manage_items...) due to a broken ownership check in removeItemFromCollection(). As a result, attackers can insert and remove items from collections they do not own. Version 5.5.3 #59 fixes the issue.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Macwarrior Oxygenz
Products
Clipbucket-v5 Clipbucket
CVE-2026-40191

ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Craigjbass
Products
Clearancekit
CVE-2026-3103

Deletion of passwords via RestApi

A logic error in the remove_password() function in Checkmk GmbH's Checkmk versions <2.4.0p23, <2.3.0p43, and 2.2.0 (EOL) allows a low-privileged user to cause data loss.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2026-26949

Elevation of Privileges via Incorrect Authorization in Dell Device Management Agent

Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Incorrect Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Device Management Agent Device Management Agent (ddma)
CVE-2026-27803

Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Dani-garcia
Products
Vaultwarden
CVE-2026-29126

World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE

Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (local privilege escalation and persistence) via modification of a root-owned, world-writable BusyBox udhcpc DHCP event script, which is executed when a DHCP lease is obtained, renewed, or lost.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Datacast International Datacasting Corporation
Products
Sfx2100 Sfx2100 Firmware Sfx2100 Satellite Receiver
CVE-2026-29127

Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100

The IDC SFX2100 Satellite Receiver sets overly permissive file system permissions on the monitor user's home directory. The directory is configured with permissions 0777, granting read, write, and execute access to all local users on the system, which may cause local privilege escalation depending on conditions of the system due to the presence of highly privileged processes and binaries residing within the affected directory.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Datacast International Datacasting Corporation
Products
Sfx2100 Sfx2100 Firmware Sfx2100 Satellite Receiver
CVE-2026-3009

Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Jboss Enterprise Application Platform and 4 more
CVE-2026-28790

OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Olivetin
Products
Olivetin
CVE-2026-28392

OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages

OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slash commands via direct message to bypass allowlist and access-group restrictions.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-28466

OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass

OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run commands. Attackers with valid gateway credentials can inject approval control fields to execute arbitrary commands on connected node hosts, potentially compromising developer workstations and CI runners.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-28473

OpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Command

OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending the /approve chat command. The /approve command path invokes exec.approval.resolve through an internal privileged gateway client, bypassing the operator.approvals permission check that protects direct RPC calls.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-28716

Improper Authorization Checks in Acronis Cyber Protect 17 Allow Information Disclosure and Manipulation

Information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.

CVSS 3.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Acronis Linux Microsoft
Products
Acronis Cyber Protect 17 Cyber Protect Linux Kernel and 1 more
CVE-2026-28720

Insufficient Authorization Checks Allow Unauthorized Settings Modification in Acronis Cyber Protect 17

Unauthorized modification of settings due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Acronis Linux Microsoft
Products
Acronis Cyber Protect 17 Cyber Protect Linux Kernel and 1 more
CVE-2026-29087

@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. This issue has been patched in version 1.19.10.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hono
Products
Node-server