Export limit exceeded: 425864 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,110

Export CSV
CVE-2026-85597

Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Traefik
Products
Traefik
CVE-2026-82053

Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-82074

Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-82073

Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improperly skipped.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-82062

Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections' data.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-86773

Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit (update on PredefinedKit) and not the child object being attached. As a result, an authenticated user holding only the kits.edit permission can attach a License, Consumable, Accessory, or Asset Model that they are otherwise denied (HTTP 403) from reading directly to a Predefined Kit, and the kit relation index then discloses the attached object's name back to that low-privilege user. This is the update-path and storeModel counterpart to CVE-2026-55478, which fixed only the storeLicense, storeConsumable, and storeAccessory methods in 8.6.2. Note that updateModel was code-vulnerable in 8.6.3 but not reachable in practice because a route-name typo bound the route to a nonexistent controller method, causing HTTP 500 responses. The issue is fixed in Snipe-IT 8.7.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Grokability Snipeitapp
Products
Snipe-it Snipe-it
CVE-2026-81165

Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Blazy Project Drupal
Products
Blazy Blazy
CVE-2026-75624

IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm Linux Microsoft
Products
Aix App Connect Enterprise Linux Kernel and 1 more
CVE-2026-57133

PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to child_process.exec(). A string that starts with an allowed read-only command can append a second non-allowlisted command through shell syntax, allowing arbitrary command execution with the PraisonAI process privileges. This issue is fixed in version 1.7.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-73478

Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096

Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Diff Project Drupal
Products
Diff Diff
CVE-2026-18572

Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid and 5 more
CVE-2026-73477

Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal Quick Tabs Project
Products
Quick Tabs Quick Tabs
CVE-2026-46460

Low-Privilege Authorization Bypass Allows Log Tampering on Dell PowerScale OneFS

Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized modification of system logs.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerscale Onefs
CVE-2026-87075

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Tanium
Products
Comply
CVE-2026-87046

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tanium
Products
Comply
CVE-2026-61910

cyrus-imapd: cyrus-imapd: Mailbox/set let sharee change special-use role on shared mailboxes

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Cyrus Cyrusimap
Products
Imap Cyrus Imap
CVE-2026-87017

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that filter. An authenticated user on an affected backend could enumerate the identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection, although the associated document text remained in separate collections. This issue is fixed in version 0.11.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open-webui Openwebui
Products
Open-webui Open Webui
CVE-2026-18703

Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-18698

Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server