Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,978

Export CSV
CVE-2026-120805

Authorization bypass via redirected FLE2 state-collection writes in encrypted CRUD path

In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. The server’s authorization layer validated only the user-facing target collection namespace, while subsequent internal writes derived from client-supplied parameters were performed with elevated internal privileges, bypassing the original caller’s permission scope. This could allow unauthorized writes into another collection’s Queryable Encryption metadata, potentially corrupting encrypted index state and compaction operations.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-111455

Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit

Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow
CVE-2026-120823

Missing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration Data

A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120826

Improper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized Access

An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-102589

Cross-instance user impersonation through image renderer JWTs

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-120815

Incorrect Authorization Check in MongoDB Server Localhost Exception Leads to Unauthorized Administrative Access

An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120816

System collection contents readable through a database change stream with showSystemEvents

A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents of certain restricted internal collections that the same user is refused on a direct read. The privilege check for the notification feature is derived only from the target namespace and does not account for the option, so no additional permission is required. This may result in unintended access to data stored in those internal collections.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120822

Missing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data Access

MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120825

Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access

An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-106133

Incorrect Authorization in Telerik Report Server Web Report Designer

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Telerik Report Server Telerik Report Server
CVE-2026-118408

Apache Roller: Unpublished entries of other weblogs readable through preview

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Roller
CVE-2026-111000

Privilege escalation through folder move in the folders API

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-111024

Folder permission bypass in the Git Sync repository files API

A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-105440

Switch Engine (EXOS) JSON-RPC Authorization Bypass Allows Read-Only Users to Disclose Sensitive Information

Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosure of sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device. This issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11. Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Extreme Networks Extremenetworks
Products
Switch Engine (exos) Switch Engine (exos)
CVE-2026-123481

WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-92083

Pardus Image Writer Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's pardus-image-writer

Missing Authorization vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pardus-image-writer allows Privilege Escalation. This issue affects pardus-image-writer: before 0.9.0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-75868

Broken Access Control

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central
CVE-2026-75867

Broken Access Control

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central