Export limit exceeded: 425894 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,017

Export CSV
CVE-2026-72681

Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-85212

CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check

CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Crmeb
Products
Crmeb
CVE-2026-84215

WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Arraytics Wordpress
Products
Timetics Wordpress
CVE-2026-81892

EasyAdmin custom-action dispatcher bypasses access_control on other routes

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Easycorp
Products
Easyadmin
CVE-2026-71415

Kirby: File upload permissions are not checked during processing of chunk data

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Getkirby
Products
Kirby
CVE-2026-84989

ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ntop
Products
Ntopng
CVE-2026-84323

chromium-browser: chromium-browser: Missing authorization in FileSystem

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-84328

chromium-browser: Google Chrome: Web origin policy bypass due to missing authorization

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-84660

Missing Permission Check Enables Unauthorized Build Cancellation in Jenkins Pipeline Build Step Plugin

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Project
Products
Jenkins Pipeline Build Step Plugin
CVE-2026-84661

Missing Permission Check Allows Unauthorized Cancellation of Downstream Builds in Jenkins Pipeline Build Step Plugin

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Project
Products
Jenkins Pipeline Build Step Plugin
CVE-2026-84674

Missing Permission Checks Allow Credential ID Enumeration in Jenkins XebiaLabs XL Deploy Plugin

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Project
Products
Jenkins Xebialabs Xl Deploy Plugin
CVE-2026-85213

Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Killbill
Products
Killbill
CVE-2026-78069

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreControllerApps`'s `appTask` delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of `fof.xml`'s wildcard-deny resolving under the singularised ACL key `app`, which has no explicit allow rule — not because of any deliberate check. Behind that path, `applocalizationdata::getInstallerTool()` used a caller-influenced table name with no allow-list, both to select a `#__j2store_*` table for truncation and to build a path to SQL files it then executes — a path-traversal-capable file read/execute.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
J2commerce.com
Products
J2store Extension For Joomla
CVE-2026-78601

Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-18058

Smart Connect UI Manipulation Enabling Privilege Escalation

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Motorola
Products
Smart Connect Application
CVE-2026-45730

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Nuclio
Products
Nuclio
CVE-2026-84204

GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval

GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Growi
Products
Growi
CVE-2026-66375

Low-privilege users may remove protected Artifactory metadata

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Jfrog
Products
Artifactory
CVE-2026-66377

Anonymous users may access restricted Artifactory repository information

An unauthenticated user may access restricted repository information under specific conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jfrog
Products
Artifactory