Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,981

Export CSV
CVE-2025-71433

Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Usekaneo
Products
Kaneo
CVE-2026-109296

Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openwebui
Products
Open Webui
CVE-2026-109287

Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open-webui Openwebui
Products
Open-webui Open Webui
CVE-2026-48168

PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name

PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.

CVSS 3.1 · 10 Critical EPSS 1.5% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-111352

ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Thinkcmf
Products
Thinkcmf
CVE-2026-56826

Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Shopperlabs
Products
Shopper
CVE-2026-110380

WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Arraytics Wordpress-extensions
Products
Wp Event Solution Wp Event Solution
CVE-2026-110900

WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Liquid Web / Stellarwp Wordpress-extensions
Products
Bookit Bookit
CVE-2026-116470

keycloak-services: keycloak-services: SCIM user listing endpoint returns full PII without per-user VIEW authorization check

A flaw was found in the SCIM user listing endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the endpoint fails to perform per-user VIEW authorization checks when returning user lists. This allows a service account or user with limited query permissions to retrieve full personally identifiable information (PII), such as names and email addresses, for all non-admin users in a realm. This could lead to unauthorized data exposure in environments where the SCIM API is enabled.

CVSS 3.1 · 4.4 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-110806

View‑Only Permissions Expose Add‑On Passwords in Devolutions Server

Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Devolutions
Products
Devolutions Server Server
CVE-2026-110287

Improper Access Control Allows Unauthorized Asset Contact Password Modification

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Devolutions
Products
Devolutions Server Server
CVE-2026-96316

Windows Routing and Remote Access Service (RRAS) Tampering Vulnerability

Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more
CVE-2026-115370

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Linuxcontainers
Products
Incus
CVE-2026-112778

Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Traefik
Products
Traefik
CVE-2026-111397

WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pt Norther Lights Production Wordpress-extensions
Products
Mapsvg Mapsvg
CVE-2026-109433

Camunda Broken Access Control via Cockpit

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Camunda
Products
Camunda 7
CVE-2026-115364

OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Openbao
Products
Openbao