Export limit exceeded: 15657 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15657 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86781 | 2026-09-11 | 5.3 Medium | ||
| The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs. | ||||
| CVE-2026-14563 | 2026-09-11 | 9.8 Critical | ||
| The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts. | ||||
| CVE-2026-81787 | 2 Idxbroker, Wordpress | 2 Impress For Idx Broker, Wordpress | 2026-09-11 | 6.5 Medium |
| Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. | ||||
| CVE-2026-86812 | 2026-09-11 | 6.5 Medium | ||
| The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order. | ||||
| CVE-2026-81796 | 2 Wordpress, Wp Travel | 2 Wordpress, Wp Travel | 2026-09-11 | 7.3 High |
| Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions. | ||||
| CVE-2026-88007 | 1 Traefik | 1 Traefik | 2026-09-11 | N/A |
| Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13. | ||||
| CVE-2026-88016 | 1 Rclone | 1 Rclone | 2026-09-11 | 7.1 High |
| rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1. | ||||
| CVE-2026-88018 | 1 Rclone | 1 Rclone | 2026-09-11 | 9.8 Critical |
| rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes the access key identifier as both the user and authentication value to the proxy without an independent per-identity secret. An unauthenticated network attacker can therefore choose an arbitrary access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. This issue is fixed in version 1.75.1. | ||||
| CVE-2026-87806 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-09-11 | 7.4 High |
| Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory as proof of authentication. A zero-length credential turns an LDAP simple bind into the unauthenticated authentication mechanism described in RFC 4513 section 5.1.2, which some directories (including Active Directory in its default configuration) answer with success while mapping the connection to anonymous. As a result, an unauthenticated attacker who knows a directory username can obtain a valid session token for that account, resulting in account takeover. Only deployments that enable the LDAP authentication adapter are affected, and deployments whose directory refuses unauthenticated simple bind (such as a stock OpenLDAP configuration) are not exploitable. The issue is fixed in 8.6.88 and 9.10.1-alpha.7, which require the password to be a non-empty string and reject the request before contacting the directory. | ||||
| CVE-2026-79387 | 1 Pbootcms | 1 Pbootcms | 2026-09-11 | N/A |
| SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover. | ||||
| CVE-2026-21099 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-09-11 | 5.5 Medium |
| Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information. | ||||
| CVE-2026-85543 | 2026-09-11 | 4.3 Medium | ||
| Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces. | ||||
| CVE-2026-21086 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-09-10 | N/A |
| Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration. | ||||
| CVE-2026-79725 | 1 Ibm | 1 Langflow Oss | 2026-09-10 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control. | ||||
| CVE-2026-21097 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-09-10 | 6.7 Medium |
| Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity. | ||||
| CVE-2026-21098 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-09-10 | N/A |
| Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction. | ||||
| CVE-2026-21100 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-09-10 | 7.1 High |
| Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity. | ||||
| CVE-2026-86084 | 1 N8n | 1 N8n | 2026-09-10 | 5.5 Medium |
| n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. | ||||
| CVE-2026-69907 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-10 | 7.8 High |
| Improper handling of insufficient permissions or privileges in Windows Enterprise App Management allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-77487 | 1 Microsoft | 11 Microsoft Sql Server 2017 (cu 31), Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (cu 32) and 8 more | 2026-09-10 | 8.8 High |
| Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||