Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,669

Export CSV
CVE-2026-70642

ToolJet < 3.21.94 Authorization Bypass via app-environments/init

ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editing_version_id from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tooljet
Products
Tooljet
CVE-2026-63505

Probo: Cross-tenant IDOR via unvalidated FK references

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.223.1, Probo's console GraphQL API is a multi-tenant GRC platform where all data is scoped to an organization. A Finding can reference a Risk via finding.riskId. That reference is stored without validating that the risk belongs to the caller's organization, and the Finding.risk field resolver authorizes the finding (caller's org) instead of the risk, then loads the risk with a tenant scope derived from the risk's own global ID. As a result, an authenticated member of organization A can attach an arbitrary organization B risk GID to a finding they own and then read organization B's Risk (name, description, treatment, category, severity, owner) — with no membership in B. The stored cross-tenant reference also blocks B from deleting its own risk (ON DELETE RESTRICT), a cross-tenant integrity/DoS. This issue has been patched in version 0.223.1.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Getprobo
Products
Probo
CVE-2026-65840

Fider: Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Getfider
Products
Fider
CVE-2026-13721

Folder authorization bypass in the Git Sync provisioning files API

A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-16237

PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition

Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2026-107193

Foreman: api filter lookup ignores a search-limited filter permission

A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Satellite Maintenance and 2 more
CVE-2026-81658

Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat Theforeman
Products
Red Hat Satellite 6 Satellite Satellite Capsule and 3 more
CVE-2026-119658

PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Powerdns-admin
Products
Powerdns-admin
CVE-2026-125330

HarnessRouter: A workspace's API key could read and change sessions, files and responses of other workspaces in the same organization

HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessable identifier from another workspace in the same organization can read sessions, conversation turns, files, traces, and responses, overwrite files, cancel or delete sessions, and publish share links. The issue does not cross organization boundaries, and console users, organization keys, and Default Workspace keys intentionally retain organization-wide access. This issue is fixed in version 0.31.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Harnessrouter
Products
Harnessrouter
CVE-2026-123291

Improper owner validation in JetBrains Datalore allows cross‑workspace data reading

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-17129

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-16304

WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids

The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Event Manager
CVE-2026-86442

WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR

The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Event Manager
CVE-2026-119751

Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Keywordrush Wordpress-extensions
Products
Content Egg Content Egg
CVE-2026-121636

Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter

The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Quick Event Manager
CVE-2026-119213

Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmanageninja
Products
Fluent Support Fluent Support
CVE-2026-17112

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-123834

Improper Scope Validation in JetBrains Datalore Allows Cross‑Workspace Service Account Abuse

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore