Export limit exceeded: 13678 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (13678 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71504 | 1 Dolibarr | 1 Dolibarr | 2026-08-27 | 8.1 High |
| Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder. | ||||
| CVE-2026-66721 | 1 Apache | 2 Apache Cloudstack, Cloudstack | 2026-08-27 | 2.7 Low |
| Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain. This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue. | ||||
| CVE-2026-77611 | 1 Seaweedfs | 1 Seaweedfs | 2026-08-27 | 7.1 High |
| SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler authorizes the request against the requested nested key but then writes the updated entry back to the bucket root rather than the key's actual parent directory, so an ACL change on allowed/protected.txt is instead applied to protected.txt at the bucket root. Because the update carries the full entry rather than only ACL metadata, an existing target object is overwritten with the content, metadata, owner information, and ACL of the scoped object, bypassing the object-level action scoping configured through the static S3 identity file. This issue is fixed in version 4.40. | ||||
| CVE-2026-79208 | 1 Google | 1 Chrome | 2026-08-27 | 5.9 Medium |
| Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-79225 | 1 Google | 2 Android, Chrome | 2026-08-27 | 4.3 Medium |
| Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via UI Interaction. (Chromium security severity: Low) | ||||
| CVE-2026-81274 | 2 Metaphorcreations, Wordpress | 2 Ditty, Wordpress | 2026-08-27 | 5.3 Medium |
| Subscriber Broken Access Control in Ditty <= 3.1.67 versions. | ||||
| CVE-2026-27140 | 2 Golang, Gotoolchain | 2 Go, Cmd/go | 2026-08-27 | 8.8 High |
| SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. | ||||
| CVE-2026-81279 | 2026-08-27 | 5.4 Medium | ||
| Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions. | ||||
| CVE-2026-79133 | 1 Google | 1 Chrome | 2026-08-27 | 6.5 Medium |
| Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-81276 | 2 Wordpress, Wp Chill | 2 Wordpress, Kali Forms | 2026-08-27 | 5.3 Medium |
| Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions. | ||||
| CVE-2026-80433 | 2026-08-27 | 7.5 High | ||
| Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions. | ||||
| CVE-2026-79286 | 1 Google | 2 Android, Chrome | 2026-08-27 | 7.4 High |
| Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium) | ||||
| CVE-2026-79218 | 1 Google | 1 Chrome | 2026-08-27 | 8.3 High |
| Incorrect authorization in Sandbox in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-66792 | 1 Redhat | 6 Acm, Advanced Cluster Management For Kubernetes, Multicluster Globalhub and 3 more | 2026-08-27 | 9.9 Critical |
| A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources. | ||||
| CVE-2026-79044 | 1 Google | 2 Android, Chrome | 2026-08-27 | 5.3 Medium |
| Missing authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79023 | 1 Google | 1 Chrome | 2026-08-27 | 6.5 Medium |
| Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79038 | 1 Google | 1 Chrome | 2026-08-27 | 6.5 Medium |
| Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79041 | 2 Apple, Google | 2 Macos, Chrome | 2026-08-27 | 4.3 Medium |
| Missing authorization in Browser in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-50222 | 1 Apache | 1 Cloudstack | 2026-08-27 | 7.5 High |
| Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue. | ||||
| CVE-2026-81027 | 2 Intel, Songquanpeng | 2 Oneapi, One-api | 2026-08-26 | 8.5 High |
| one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the caller, while the path-parameter branch sets the selected-channel value from c.Param("channelid") with no role check at all. The route carrying that parameter sits behind token authentication only, so any account holding a valid API token reaches it. The value flows to the distributor, which loads the channel by integer identifier with no scoping to the caller's user or group, and then sets the outbound Authorization header to that channel's stored key and directs the request at the channel's base URL. A low-privilege account can therefore pin any channel by incrementing an identifier, causing the server to make upstream requests bearing an operator-configured provider key the account was never granted, and bypassing both the per-group restriction and the channel's model allowlist. | ||||