Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,661

Export CSV
CVE-2025-71460

Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction

Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126275

NocoDB before 2026.09.0 IDOR in Row Comment Operations

NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126313

Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records

Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126376

Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets

Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing admin_id owner scoping. Attackers can supply filter[admin_id] to list drafts, invoke duplicate() on posts or products, or enumerate every vendor's digital-asset metadata.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126437

OpenEMR before 8.5.0 Authorization Bypass via portal/lib/download_template.php

OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126441

OpenEMR before 8.5.0 IDOR via CAMOS rx_print.php Prescription Disclosure

OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescription IDs to disclose drug names, dosages, directions, and refill counts without medication permissions.

CVSS 4.0 · 6 Medium EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126452

OpenEMR before 8.5.0 Missing Authorization via diagnosis_full.php Billing Operations

OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated users to delete or clear any billing record by ID. Attackers can supply a target billing ID in the id parameter with delete or clear mode to deactivate other patients' charges and corrupt financial records.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126470

OpenEMR before 8.5.0 IDOR in Carecoordination CCDA/CCR/QRDA Document Actions

OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126472

OpenEMR before 8.5.0 Missing Authorization in ccdaservice/ccda_gateway.php C-CDA Disclosure

OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126942

Zipline before 4.6.2 Missing Authorization via POST /api/user/folders

Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder seeded with them, disclosing victims' file URLs and removing those files from their folder views.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126948

Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints

Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127076

OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API

OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127078

OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127081

OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127085

Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127086

Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127087

Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128045

OpenMage Magento-LTS before 20.18.2 Authorization Bypass via Forgeable RSS Order Key

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-82978

Authorization Bypass Enabling Cross-Agency Rule Set Creation

An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule set belonging to another agency by changing the submitted agencyid parameter. The server trusts the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than submitted form data and removing the agency identifier from the form's hidden fields.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Revive
Products
Adserver
CVE-2026-68486

Authorization Bypass in Revive Adserver Campaign‑Zone Linking

An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Revive
Products
Adserver