Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,110

Export CSV
CVE-2026-46150

fanotify: fix false positive on permission events

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached marks that are not in the current group.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-43334

Bluetooth: SMP: force responder MITM requirements before building the pairing response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-112047

OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hackerbay Oneuptime
Products
Oneuptime Oneuptime
CVE-2026-110453

nix: nix: Unauthorized daemon access via unsandboxed build user connections

Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nixos
Products
Nix
CVE-2025-68803

NFSD: NFSv4 file creation neglects setting ACL

In the Linux kernel, the following vulnerability has been resolved: NFSD: NFSv4 file creation neglects setting ACL An NFSv4 client that sets an ACL with a named principal during file creation retrieves the ACL afterwards, and finds that it is only a default ACL (based on the mode bits) and not the ACL that was requested during file creation. This violates RFC 8881 section 6.4.1.3: "the ACL attribute is set as given". The issue occurs in nfsd_create_setattr(), which calls nfsd_attrs_valid() to determine whether to call nfsd_setattr(). However, nfsd_attrs_valid() checks only for iattr changes and security labels, but not POSIX ACLs. When only an ACL is present, the function returns false, nfsd_setattr() is skipped, and the POSIX ACL is never applied to the inode. Subsequently, when the client retrieves the ACL, the server finds no POSIX ACL on the inode and returns one generated from the file's mode bits rather than returning the originally-specified ACL.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-111929

Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Coder
Products
Coder
CVE-2026-111875

David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization

A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
David-crty
Products
Databasement
CVE-2026-112001

ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Projectsend
Products
Projectsend
CVE-2026-111928

Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Coder
Products
Coder
CVE-2026-110867

Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Mend Renovatebot
Products
Mend-renovate-ce Helm Chart Mend-renovate-enterprise-edition Helm Chart Renovate-ce and 3 more
CVE-2026-89072

MOVEit Transfer Authorization Flaw in Certificate Management

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Moveit Transfer
CVE-2026-6723

Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This makes it possible for unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Croixhaug Wordpress-extensions
Products
Simply Schedule Appointments Simply Schedule Appointments
CVE-2026-92817

Inductive Automation Ignition Software Incorrect Authorization

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Inductiveautomation
Products
Ignition
CVE-2026-78433

Gitea private attachment disclosure through repository mismatch

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-73804

Gitea API token scope escalation through HTTP signatures

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-70396

Gitea organization repository creation token scope bypass

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-109181

jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jishenghua
Products
Jsherp
CVE-2026-111888

phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq
Products
Phpmyfaq
CVE-2026-70406

Gitea private comparison disclosure with public-only tokens

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head repository accessible to the token owner. This bypasses the token's public-only restriction; it does not remove the account's underlying repository permission checks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea