Export limit exceeded: 14100 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (14100 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-72563 | 1 Badchoice | 1 Handesk | 2026-08-13 | 8.1 High |
| A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams via the LeadsController@update endpoint. The endpoint performs no authorization check, and the Lead model has guarded set to an empty array making all columns mass-assignable. An attacker with any agent account can corrupt lead data across team boundaries. | ||||
| CVE-2026-72595 | 1 Badchoice | 1 Handesk | 2026-08-13 | 8.1 High |
| A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize() method and performs no team-scoped ownership check. An attacker with any agent account can modify, escalate, or corrupt tickets assigned to other teams. | ||||
| CVE-2026-72600 | 1 Idurar | 1 Idurar Erp Crm | 2026-08-13 | 7.5 High |
| A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials. | ||||
| CVE-2026-18961 | 2 Fahdaslam, Wordpress | 2 Social Login, Passkeys, Magic Link & Email Otp – Passwordless Login By Ventraconnect, Wordpress | 2026-08-13 | 8.1 High |
| The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site. | ||||
| CVE-2026-67283 | 1 Tabaoca.org | 1 Cotton Cloud Extension For Joomla | 2026-08-13 | N/A |
| Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on every file managed within the extension. | ||||
| CVE-2026-67284 | 1 Tabaoca.org | 1 Cotton Cloud Extension For Joomla | 2026-08-13 | N/A |
| Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on files owned by other users. | ||||
| CVE-2026-13328 | 2026-08-13 | N/A | ||
| The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations. | ||||
| CVE-2026-51584 | 1 Usememos | 1 Memos | 2026-08-13 | 9.8 Critical |
| An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim. | ||||
| CVE-2026-12571 | 1 Zohocorp | 1 Manageengine Ddi Central | 2026-08-13 | 9.8 Critical |
| An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover. | ||||
| CVE-2026-65675 | 1 Microsoft | 1 Visual Studio Code Copilot Chat Extension | 2026-08-13 | 7.1 High |
| No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-73085 | 1 Advplyr | 1 Audiobookshelf | 2026-08-13 | N/A |
| Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0. | ||||
| CVE-2026-17008 | 2026-08-13 | 5.3 Medium | ||
| The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid. | ||||
| CVE-2026-70468 | 1 Fortinet | 2 Fortimanager, Fortimanagercloud | 2026-08-13 | 7.3 High |
| A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, FortiManager Cloud 7.4.3 through 7.4.5, FortiManager Cloud 7.2.5 through 7.2.9 may allow attacker to improper access control via <insert attack vector here> | ||||
| CVE-2026-14859 | 2026-08-13 | 4.3 Medium | ||
| The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission. | ||||
| CVE-2026-26035 | 1 Fortinet | 1 Fortiweb | 2026-08-13 | 8.8 High |
| An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password | ||||
| CVE-2026-72917 | 1 Mintplexlabs | 1 Anything-llm | 2026-08-12 | 5.9 Medium |
| AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account. | ||||
| CVE-2026-47718 | 1 Frangoteam | 1 Fuxa | 2026-08-12 | N/A |
| FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue. | ||||
| CVE-2026-68760 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 5.3 Medium |
| An unauthenticated user may bypass authentication under specific cache conditions. | ||||
| CVE-2026-13171 | 2 Eventin, Wordpress | 2 Eventin, Wordpress | 2026-08-12 | 8.2 High |
| The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records. | ||||
| CVE-2026-16538 | 2026-08-12 | 9.1 Critical | ||
| The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value. | ||||