Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,977

Export CSV
CVE-2026-126419

OpenEMR before 8.5.0 Missing Authorization in E-Sign Form Submission

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and encounterId values to sign and lock any patient's clinical form, creating unauthorized approval records and blocking normal editing.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126415

OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters to the patientvalidation endpoint to enumerate the entire patient_data table.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126414

Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints

Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Hrms
CVE-2026-126413

Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization on File Details Endpoint

Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Hrms
CVE-2026-126412

Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization in Bulk Record Action

Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role can run the action to create and submit records for every covered employee.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Hrms
CVE-2026-126317

Frappe HRMS 16.0.0 before 16.20.1 Missing Authorization in Company Details Endpoint

Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Hrms
CVE-2026-112830

WordPress Brizy plugin <= 2.8.25 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Brizy Wordpress-extensions
Products
Brizy Brizy
CVE-2026-126373

Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions

Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post_id, language_id, and created_at timestamp to retrieve private unpublished drafts, because the revision() action lacks the admin_id ownership restriction.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2026-128077

Nuxt: Incomplete fix for CVE-2026-119200: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, Nuxt parses a request path beginning with // as a URL host before rendering a page, while Nitro server/middleware and routeRules continue to evaluate the original path. An unauthenticated request such as //x/admin can therefore resolve to the /admin page without route-scoped serverHandlers, server/middleware path checks, redirects, or security headers configured for /admin. API handlers in server/api and server/routes, appMiddleware, page middleware are unaffected. This issue is fixed in version 4.6.4.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126850

chromium-browser: chromium-browser: Incorrect authorization in SiteIsolation

Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android Chrome
CVE-2026-126854

chromium-browser: chromium-browser: Incorrect authorization in Layout

Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126855

chromium-browser: chromium-browser: Missing authorization in ImageCapture

Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126318

REDAXO before 5.21.6 Authorization Bypass of Live Version Permission

REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, content_slice_status, content_move_slice, history restore, or content_copy, bypassing approval workflows.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redaxo
Products
Core Redaxo
CVE-2026-126314

Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Hrms
CVE-2026-63174

Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-128071

Nuxt: Incomplete fix for GHSA-6gq8-jgmh-3ffp: an encoded slash (`%2F`) in the request path bypasses route rules on catch-all page routes

Nuxt is an open-source web development framework for Vue.js. Nuxt from 3.0.0 until 4.6.4, @nuxt/nitro-server from 3.20.0 until 4.6.4, and @nuxt/vite-server from 4.6.0 until 4.6.4, routeRules matching leaves an encoded slash (%2F) in the request path while a catch-all page such as app/pages/[...slug].vue or a custom multi-segment page route decodes it into a route parameter. The getRouteRules result is therefore incomplete, and an unauthenticated request can render the page without the redirect, headers, proxy, SSR, noScripts, appMiddleware, or appLayout rules configured for the decoded path. Protected content is resolved only when the page interprets the decoded parameter accordingly: a custom multi-segment parameter can contain the decoded path, while a repeatable catch-all must join the slash-containing array element; route.path remains encoded and does not resolve that resource. Static pages, single-segment parameters, server/api handlers, and server/routes handlers are not affected because they do not have the same encoded-path mismatch. This issue is fixed in version 4.6.4.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-63172

Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-129143

paicoding 1.0.3 Missing Authorization via Article Detail API Endpoint

paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Itwanger
Products
Paicoding
CVE-2026-129157

ragent 1.0.0 through 1.1.0 Missing Authorization via /rag/traces/runs

ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-92904

Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check

A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Satellite 6 Satellite