Export limit exceeded: 15884 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15884 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-70476 | 1 Flowiseai | 1 Flowise | 2026-09-11 | 8.2 High |
| Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3. | ||||
| CVE-2026-88895 | 1 Cyberpanel | 1 Cyberpanel | 2026-09-11 | 7.2 High |
| CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor. | ||||
| CVE-2026-70910 | 1 Oracle | 2 Siebel Crm, Siebel Crm Integration | 2026-09-11 | 7.5 High |
| Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). | ||||
| CVE-2026-42018 | 1 Jfrog | 1 Artifactory | 2026-09-11 | 7.5 High |
| JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. | ||||
| CVE-2026-75998 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-09-11 | 7.5 High |
| ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-81906 | 1 Concretecms | 1 Concrete Cms | 2026-09-11 | N/A |
| Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully authenticated for the callback response, with the login recorded and login events dispatched. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting. | ||||
| CVE-2026-14559 | 2026-09-11 | 9.8 Critical | ||
| The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address. | ||||
| CVE-2026-44492 | 1 Axios | 1 Axios | 2026-09-11 | 8.6 High |
| Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0. | ||||
| CVE-2026-44249 | 1 Netty | 1 Netty | 2026-09-11 | 8.1 High |
| Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue. | ||||
| CVE-2026-39828 | 1 Golang | 2 Crypto, Ssh | 2026-09-11 | 6.3 Medium |
| When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error. | ||||
| CVE-2026-14563 | 2026-09-11 | 9.8 Critical | ||
| The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts. | ||||
| CVE-2026-81787 | 2 Idxbroker, Wordpress | 2 Impress For Idx Broker, Wordpress | 2026-09-11 | 6.5 Medium |
| Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. | ||||
| CVE-2026-86812 | 2026-09-11 | 6.5 Medium | ||
| The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order. | ||||
| CVE-2026-81796 | 2 Wordpress, Wp Travel | 2 Wordpress, Wp Travel | 2026-09-11 | 7.3 High |
| Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions. | ||||
| CVE-2026-87806 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-09-11 | 7.4 High |
| Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory as proof of authentication. A zero-length credential turns an LDAP simple bind into the unauthenticated authentication mechanism described in RFC 4513 section 5.1.2, which some directories (including Active Directory in its default configuration) answer with success while mapping the connection to anonymous. As a result, an unauthenticated attacker who knows a directory username can obtain a valid session token for that account, resulting in account takeover. Only deployments that enable the LDAP authentication adapter are affected, and deployments whose directory refuses unauthenticated simple bind (such as a stock OpenLDAP configuration) are not exploitable. The issue is fixed in 8.6.88 and 9.10.1-alpha.7, which require the password to be a non-empty string and reject the request before contacting the directory. | ||||
| CVE-2026-21099 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-09-11 | 5.5 Medium |
| Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information. | ||||
| CVE-2026-21086 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-09-10 | N/A |
| Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration. | ||||
| CVE-2026-21097 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-09-10 | 6.7 Medium |
| Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity. | ||||
| CVE-2026-21098 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-09-10 | N/A |
| Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction. | ||||
| CVE-2026-21100 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-09-10 | 7.1 High |
| Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity. | ||||