Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,015

Export CSV
CVE-2026-109627

Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role permits.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2026-109622

Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising data integrity.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2026-62040

WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-102596

Nango: Production flow RBAC bypass on private flow-read routes

Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: 'read', resource: 'flow', scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nangohq
Products
Nango
CVE-2026-76272

Missing Access Control through the REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user is authorized to request a signature. Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are also affected. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Enterprise Splunk Secure Gateway
CVE-2026-106176

Unauthorized Code Execution via Specially Crafted HTTP Requests in FortiSIEM

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Fortinet
Products
Fortisiem
CVE-2026-108708

Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil

Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Wukongopensource
Products
Wukong Hrm
CVE-2026-108703

CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations or orders to alter their approval status and read approval details.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
1panel-dev Fit2cloud
Products
Cordyscrm Cordys Crm
CVE-2026-108678

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate role assignments and identify administrator accounts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg-boot Jeecg Boot
CVE-2026-108673

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to export all AI prompts. Low-privileged attackers can request /airag/prompts/exportXls to download every user's prompts, including prompt content, model ids, and parameters, as an Excel workbook.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot Jeecgboot
CVE-2026-108668

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-bin templates belonging to administrators or other users.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot Jeecgboot
CVE-2026-108663

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to delete pending applications in any tenant and notify applicants of rejection.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot Jeecgboot
CVE-2026-108658

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full sys_tenant records, including house numbers used as tenant join codes and company profile fields.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg-boot Jeecg Boot
CVE-2026-108653

JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can query GET /openapi/list to read virtual paths, internal origin URLs, IP whitelists, and header and parameter templates intended for administrators.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg-boot Jeecg Boot
CVE-2026-108648

JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to retrieve JDBC URLs, usernames and decrypted cleartext database passwords.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot Jeecgboot
CVE-2026-108643

JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to recursively delete entire sys_category subtrees, breaking dependent forms and dictionary fields.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot Jeecgboot
CVE-2026-108638

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108633

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button and data rule grants to any department for delegation to its roles.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg-boot Jeecg Boot
CVE-2026-108628

JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot Jeecgboot
CVE-2026-108623

JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table, erasing all users' audit trails.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot Jeecgboot