Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,983

Export CSV
CVE-2026-110537

Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-111627

HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Hestiacp
CVE-2026-111666

Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API

Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Steedos
Products
Steedos-platform
CVE-2026-110366

WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Geminilabs Wordpress-extensions
Products
Site Reviews Site Reviews
CVE-2026-110014

Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Salon Booking System
CVE-2026-65529

WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Graphina – Charts and Graphs For Elementor: from n/a through 3.1.12.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Iqonicdesign Wordpress
Products
Graphina Wordpress
CVE-2026-113649

ApostropheCMS: Import API bypasses publication roles for protected content

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks. This issue is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apostrophecms
Products
Apostrophecms Import-export
CVE-2026-113648

ApostropheCMS: Missing Authentication in `cleanExport` Route

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Apostrophecms
Products
Apostrophecms Import-export
CVE-2026-113611

Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Getoutline
Products
Outline
CVE-2026-113601

Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Usememos
Products
Memos
CVE-2026-110873

Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field

Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Heymrun
Products
Heym
CVE-2026-102985

Plane: Any project member can modify (deactivate) other members' records

Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including deactivating a project administrator. ProjectMemberPreferenceEndpoint.patch separately trusts the member_id path value and lets a project member overwrite another member's preferences. These missing object-level authorization checks permit membership disruption and cross-member preference tampering. The vulnerability is fixed in 1.4.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Makeplane
Products
Plane
CVE-2026-71854

OpenAEV has unauthenticated access and missing object-level authorization on player lessons API

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Openaev-platform
Products
Openaev
CVE-2026-77930

EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents

EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Evoscientist
Products
Evoscientist
CVE-2026-113354

Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Finsys
Products
Dockhand
CVE-2026-112783

OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Opencats
Products
Opencats
CVE-2026-109444

OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection

OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Tracer-cloud
Products
Opensre
CVE-2026-91156

Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Discourse
Products
Discourse
CVE-2026-75850

ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers

ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Arcadedata
Products
Arcadedb
CVE-2026-71424

Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Onyx
Products
Onyx