Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,671

Export CSV
CVE-2026-73488

Flowise before 3.1.3 IDOR via customer-default-source endpoint

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Flowiseai
Products
Flowise
CVE-2026-81892

EasyAdmin custom-action dispatcher bypasses access_control on other routes

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Easycorp
Products
Easyadmin
CVE-2026-85182

vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Lenve
Products
Vhr
CVE-2026-81194

MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Masterstudy Lms Wordpress Plugin Wordpress
CVE-2026-81196

MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Masterstudy Lms Wordpress Plugin Wordpress
CVE-2026-81198

MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Masterstudy Lms Wordpress Plugin Wordpress
CVE-2026-84672

Entra Group Permission Collision in Jenkins Plugin Enables Privilege Escalation

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Jenkins Project
Products
Jenkins Microsoft Entra Id Plugin
CVE-2026-80254

Authorization Bypass via User‑Controlled Key Allows Password Change

Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the product may change the other user's password.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Shizen Connect
Products
Shizenbox2 (edge-app)
CVE-2026-85214

vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Lenve
Products
Vhr
CVE-2026-85211

Label Studio through 1.23.0 Cross-Organization Storage URI Resolution

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Humansignal
Products
Label Studio
CVE-2026-85177

CRMEB through 6.0.0 Unauthorized Message Modification via edit_message

CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crmeb
Products
Crmeb
CVE-2026-14326

Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Timetics Wordpress
Products
Timetics Wordpress
CVE-2026-78064

Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `fof.xml` grants the `carts` view's tasks a wildcard `true` ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end `format=raw` requests. `J2StoreControllerCarts` already scoped `remove()` to the caller's own session, but never overrode the generic FOF `save` task, so it remained reachable to insert new cart rows with an attacker-chosen `user_id`/`session_id`, or overwrite an existing row by id.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
J2commerce.com
Products
J2store Extension For Joomla
CVE-2026-78065

Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `editAddress()` redirected non-owners away only when the loaded address row had a **non-empty** `user_id` belonging to someone else. Guest-checkout address rows have an empty `user_id`, so that check never triggered for them — any logged-in account guessing a small, sequential `address_id` got a guest customer's full name, street address, and phone number rendered prefilled into the edit form.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
J2commerce.com
Products
J2store Extension For Joomla
CVE-2026-85105

NousResearch hermes-agent Session Management s71.py _sess_nowait authorization

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Management. This manipulation of the argument session_id causes authorization bypass. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nousresearch
Products
Hermes-agent
CVE-2026-84205

GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval

GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Growi
Products
Growi
CVE-2026-37236

github.com/grpc-ecosystem/grpc-gateway: grpc-gateway: Access control bypass via X-HTTP-Method-Override header

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Grpc-ecosystem
Products
Grpc-gateway
CVE-2026-79990

GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete

Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms
CVE-2026-84796

Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Craft Cms