Export limit exceeded: 12015 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,015

Export CSV
CVE-2026-111606

Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Hcengineering
Products
Huly Platform
CVE-2026-111349

Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Puemos
Products
Craftplan
CVE-2026-111235

OpenNMS REST authorization bypass via non-canonical HTTP method

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
The Opennms Group
Products
Horizon Meridian
CVE-2026-111277

NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nivocart
Products
Nivocart
CVE-2026-110218

Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Aureus Erp
CVE-2026-109119

Missing Authorization in rdiffweb

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ikus-soft
Products
Rdiffweb
CVE-2026-107795

Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API

Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations.  Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Software Controller
CVE-2026-110211

SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint

iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Iflytek
Products
Skillhub
CVE-2026-110216

youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Youlai
Products
Youlai-boot
CVE-2026-85990

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Leantime
Products
Leantime
CVE-2026-110123

Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints

Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Maku
Products
Maku-boot
CVE-2026-111646

SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Surveyking
Products
Surveyking
CVE-2026-111631

Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-102779

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomlafry.com Techfry
Products
Tf Content For Joomla Tf Content
CVE-2026-111652

Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Engineercms Project
Products
Engineercms
CVE-2026-105973

Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109982

MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—