Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,110

Export CSV
CVE-2026-67204

BookStack < 26.05.4 Broken Access Control via Image Gallery API

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bookstackapp
Products
Bookstack
CVE-2026-43621

Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Simplemachines
Products
Simple Machines Forum Smf
CVE-2026-103758

Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route

Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mcp-connect-composite/ route. Basic-role users with a composite MCP ID can proxy requests through mcpGateway.Proxy to invoke tools on MCP servers restricted by Access Control Rules.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Obot-platform
Products
Obot
CVE-2026-103265

Fleet before 4.89.0 Information Disclosure via MDM Command Results

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fleetdm
Products
Fleet
CVE-2026-101006

Frappe HR Permission Validation __init__.py get_attendance_requests authorization

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/api/__init__.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote exploitation of the attack is possible. The vendor replied: "This issue has already been reported by another individual, and based on that, we have fixed it."

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Hr
CVE-2026-101000

Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Netcore
Products
Nbr100v2
CVE-2026-95340

chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page

Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-103284

Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without proper authorization checks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103273

Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-95375

chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page

Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-95368

chromium-browser: Incorrect authorization in DevTools

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-81158

Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113

Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal Entity Api Project
Products
Entity Api Entity Api
CVE-2026-47591

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Privilege escalation via read-only memory protection bypass

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Nvs Quadro and 3 more
CVE-2026-47571

Vulnerability in NVIDIA GPU Driver Allows Local Privilege Escalation

NVIDIA GPU Display Driver for Windows contains a vulnerability in kernel-mode escape handling where an attacker with local access could bypass an authorization check that is intended to restrict certain operations based on client execution context. A successful exploit of this vulnerability might lead to escalation of privilege, information disclosure, data tampering, denial of service, or code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Guest Driver Nvs and 5 more
CVE-2026-95292

chromium-browser: Incorrect authorization in Safebrowsing

Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-101062

Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already logged-in user with no consent screen, an attacker who registers a client pointing at their own domain and induces a logged-in victim to visit a single crafted authorization URL receives an authorization code at the attacker-controlled redirect URI and can exchange it for an access token and refresh token. The token minted by the MCP OAuth flow carries the victim's full group set in the JWT, and Obot validated only the issuer and not the audience, so the token is accepted as a bearer token against any Obot API endpoint the victim can access rather than being scoped to the requested MCP server, allowing the attacker to read or modify the victim's resources until the token is revoked. v0.23.0 adds a consent screen, restricts MCP OAuth tokens to the MCP involved in the request, and enforces audience validation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Obot-platform
Products
Obot
CVE-2026-100879

zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zhistaredu
Products
Startraining
CVE-2025-68129

Auth0-PHP SDK has Improper Audience Validation

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Auth0
Products
Auth0-php Laravel-auth0 Symfony and 1 more
CVE-2026-103547

LDAP Authentication Bypass via Reused File Descriptor and Message ID in OpenBSD ldapd

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openbsd
CVE-2026-102568

Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including DNS filtering and application limits without authentication.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pardus
Products
Pardus-parental-control