By weakness (CWE)

CWE-862: related vulnerabilities

CVEs classified under CWE-862. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

359 published vulnerabilities · page 1 of 4

• CVE-2025-53345HIGH 8.8

  ThimPress Thim Core contains a missing authorization vulnerability that allows authenticated users to execute arbitrary code by installing a malicious plugin. An attacker with legitimate user access can bypass security checks intended to restrict plugin installation, enabling them to deploy and run arbitrary code on the affected WordPress installation. This is a post-authentication attack that significantly expands an attacker's capability once they have gained initial user credentials.

• CVE-2026-12407HIGH 8.8

  The E2Pdf plugin for WordPress contains a privilege escalation vulnerability that allows authenticated users with a specific custom role to become administrators. The flaw exists in how the plugin handles screen options updates—it fails to properly verify user permissions and validate input, allowing attackers to modify critical WordPress settings like the default user role. An administrator must have explicitly granted the attacker's role the 'e2pdf_templates' capability for this to be exploitable, but the plugin itself allows administrators to assign this capability to any role, including Subscriber or Contributor.

• CVE-2026-14460HIGH 8.8

  A missing authorization flaw in pardus-software versions up to and including 1.0.4 allows local users with standard privileges to inject arbitrary arguments into the application, potentially gaining elevated access or capabilities. The vulnerability requires an authenticated local account but does not require user interaction to exploit, making it a practical risk in multi-user or shared-system environments.

• CVE-2026-4297HIGH 8.8

  A plugin for WordPress called Welcome Software Publishing fails to properly check user permissions before letting authenticated users change critical site settings. While the plugin verifies that a user's login credentials are valid, it skips the authorization step that would confirm they actually have permission to modify options. This means any user with the lowest-level subscriber account can exploit this to change how WordPress assigns roles to new users—specifically to make them administrators—and then register themselves as an admin. The result is complete compromise of the WordPress site.

• CVE-2026-44848HIGH 8.8

  Portainer Community Edition versions 2.33.0 through 2.33.7, 2.39.x (before 2.39.2), and 2.40.x (before 2.41.0) fail to properly restrict access to Docker plugin management endpoints. This means any standard user granted access to a Docker endpoint through Portainer can perform privileged operations like installing and enabling plugins directly on the underlying Docker daemon—something normally restricted to administrators. The flaw stems from missing access control handlers on the /plugins/* endpoints, allowing RBAC bypass for a critical management function.

• CVE-2026-44849HIGH 8.8

  Portainer Community Edition has a security control bypass where administrators can restrict what kinds of containers non-admin users are allowed to launch—such as preventing privileged containers or restricting device access. However, when users create containers through the Docker Swarm API instead of the standard container creation path, several of these restrictions are ignored. An authenticated attacker with basic user privileges could bypass these restrictions to launch more dangerous containers than policy allows. The issue affects versions 2.33.0 through 2.33.7, 2.39.0 through 2.39.1, and 2.40.x, with fixes available in 2.33.8, 2.39.2, and 2.41.0.

• CVE-2026-46414HIGH 8.8

  Microsoft UFO, an open-source framework for intelligent automation across devices and platforms, contains a critical authentication bypass in version 3.0.1-4-ge2626659. The vulnerability allows any authenticated client to impersonate higher-privilege roles and send malicious automation tasks to other connected devices. An attacker with valid credentials to the WebSocket control plane can register as a normal device, then switch to a privileged 'constellation' role mid-session and direct tasks to victim systems. Additionally, the client registry allows duplicate registrations that overwrite and disconnect legitimate devices from the network.

• CVE-2026-46444HIGH 8.8

  Flowise versions prior to 3.1.2 contain a critical authentication flaw in the OpenAI Assistants Vector Store endpoints. Any authenticated user with a valid API key can perform unrestricted create, read, update, and delete operations on vector store data without additional permission checks. This means a low-privileged user or compromised API key can manipulate vector stores that should only be accessible to specific users or administrative roles.

• CVE-2026-47125HIGH 8.8

  Arcane, a Docker container management interface, has a critical flaw in how it protects global environment variables. Any logged-in user—not just administrators—can modify system-wide configuration values that affect every containerized project. An attacker could inject malicious registry URLs, database credentials, or other secrets into these shared variables, poisoning deployments across the entire system. The vulnerability exists in versions prior to 1.19.2 and requires only basic authentication to exploit.

• CVE-2026-5228HIGH 8.8

  WriteUp Mobile App versions 1.3.0 through 04062026 contain an access control flaw that allows authenticated users to perform actions they should not have permission to execute. An attacker with legitimate credentials can bypass the application's authorization checks to access or modify restricted functionality. This is a post-authentication vulnerability—the attacker must have a valid account, but once logged in, the broken permission system fails to prevent unauthorized operations.

• CVE-2026-53821HIGH 8.8

  OpenClaw before version 2026.5.18 has a critical authorization flaw in its WebSocket implementation. The vulnerability allows unpaired or restricted Control UI clients to claim elevated operator.admin permissions without proper server validation. Once a WebSocket connection is established, an attacker can execute administrative Gateway RPCs (remote procedure calls) that should only be available to fully authorized administrators. The core issue is that the server accepts client-declared permission scopes before verifying the client's actual binding status or trusted-proxy authorization.

• CVE-2026-56115HIGH 8.8

  Bootimus versions up to 0.1.70 suffer from a privilege escalation vulnerability that allows low-privileged authenticated users to perform administrative actions without proper authorization. The flaw exists in the JWT token validation logic, which checks whether a user is logged in and has an active account, but neglects to verify whether that user holds administrator rights. An attacker with legitimate access can exploit this gap to create new admin accounts or reset existing administrator passwords, effectively taking over the entire Bootimus server. This is particularly dangerous because Bootimus serves boot menus and installation scripts to PXE clients—meaning an attacker could modify the operating system images or scripts deployed across your infrastructure.

• CVE-2026-56396HIGH 8.8

  phpMyFAQ versions before 4.1.4 contain a privilege escalation vulnerability in user management endpoints. An authenticated administrator account with basic user-editing permissions can exploit missing authorization checks to promote themselves or other accounts to SuperAdmin level, bypassing the intended role hierarchy. This requires an attacker to already have legitimate admin access, but the vulnerability allows them to exceed their assigned privileges.

• CVE-2026-56423HIGH 8.8

  MISP Core contained authorization flaws in bulk deletion operations for Event Reports and Sharing Groups. Rather than verifying that a user owned or had explicit permission to delete each selected item, the system only checked whether the user held a broad role-level permission (such as 'contributor' or 'sharing group capable'). An authenticated attacker could exploit this to delete Event Reports or Sharing Groups belonging to other organizations, causing permanent loss of data or configuration across the entire MISP instance.

• CVE-2026-56424HIGH 8.8

  MISP, a widely-used threat intelligence sharing platform, contained multiple authorization flaws that allowed authenticated users to modify or delete data belonging to other organizations. Instead of checking whether a user owned the data they were trying to change, the application sometimes checked permissions against the wrong object or skipped the ownership check entirely. This meant a user with basic access could tamper with event reports, intelligence collections, analyst notes, templates, and decay models belonging to competitors or other organizations—potentially corrupting shared threat intelligence and disrupting security teams' workflows.

• CVE-2026-56767HIGH 8.8

  Maxun versions before 0.0.42 suffer from a cross-tenant access control bypass that lets any authenticated user view and manipulate other users' automation robots and stored API credentials. An attacker with legitimate access to the platform can read plaintext Google and Airtable tokens belonging to other accounts, modify or delete their workflows, and execute their robots without permission. This is a direct result of missing ownership verification in the API layer.

• CVE-2026-56768HIGH 8.8

  Seahub versions before 13.0.23 contain an authentication bypass vulnerability in their file-sharing API. When a user shares a folder via link, the system should require login for access—but this check is missing on one specific endpoint. An attacker who obtains a share-link token can use it to request a download of the entire shared folder as a ZIP file without authenticating, even if the share was restricted to logged-in users only. This allows unauthorized bulk extraction of sensitive data from what administrators believed was a protected share.

• CVE-2026-56773HIGH 8.8

  Teable's v2 REST API has a flaw where certain endpoints don't enforce proper permission checks. This means any user with basic access to a Teable instance can read sensitive table structures, create new tables, and modify or delete data across the entire system—far beyond what their role should allow. The vulnerability stems from missing permission metadata on API handlers, letting requests slip through without authorization validation.

• CVE-2026-57518HIGH 8.8

  Pagekit CMS versions up to 1.0.18 contain a privilege escalation flaw that allows authenticated users with user management permissions to grant themselves elevated access rights. Once elevated, attackers can install malicious PHP packages through the system's admin installer, leading to complete system compromise. The vulnerability requires initial authentication but chains to remote code execution with minimal difficulty.

• CVE-2026-58165HIGH 8.8

  OpenZiti, a zero-trust networking platform, contains a privilege escalation flaw that allows authenticated users with enrollment management permissions to impersonate administrators. An attacker with these limited permissions can trick the system into issuing administrative credentials, effectively hijacking the entire network controller and gaining full control over the zero-trust overlay. The vulnerability exists because the system fails to verify that an enrollment request comes from someone authorized to act on behalf of the target identity.

• CVE-2026-58168HIGH 8.8

  DeepTutor before version 1.4.10 has a flaw that lets low-privilege users run any tool connected to the system without proper authorization checks. When a system administrator forgets to explicitly deny access to certain tools (Model Context Protocol or MCP tools), the software defaults to allowing everything instead of blocking access. This means an attacker or malicious prompt inside a user's session can use any available tool—like accessing files, running shell commands, or controlling a browser—potentially compromising sensitive data and system integrity.

• CVE-2026-7761HIGH 8.8

  The Ultimate Member WordPress plugin contains a critical chain of three separate logic flaws that attackers can combine to steal password reset links for any user, including site administrators. A contributor-level user (the lowest privilege WordPress role that can create content) can exploit this by creating a specially crafted post with hidden metadata, then manipulating the plugin's member directory feature to expose password reset URLs for the entire user base. Once an attacker obtains an admin's password reset link, they can take over the account without needing the current password.

• CVE-2026-7802HIGH 8.8

  The Frontend Admin plugin for WordPress contains a critical flaw that allows low-privilege attackers to hijack administrator accounts. Any authenticated user—even with basic subscriber permissions—can change an admin's password, email address, and other profile information by manipulating a form parameter. This transforms a subscriber account into a full site compromise. The vulnerability only affects configurations where the plugin's 'Roles' setting is left unconfigured; properly configured instances with a defined roles list block this attack.

• CVE-2026-49991HIGH 8.6

  RustFS 1.0.0-beta.4 contains a critical flaw in its Snowball auto-extract feature that allows authenticated users to bypass multi-tenant isolation. An attacker with only the permission to upload files to their own bucket can manipulate file paths during extraction to write files into other users' buckets, compromising data confidentiality and integrity across the entire system. The vulnerability exploits a chain of three separate validation failures in path handling and permission checking.

• CVE-2026-55638HIGH 8.6

  9Router, an AI-based router designed to optimize and reduce token consumption for language model API calls, contains an authentication bypass vulnerability in versions before 0.5.2. The vulnerability exists because the application's URL protection rules in its dashboard guard don't cover the /codex endpoint. An attacker can exploit this gap by sending unauthenticated requests directly to /codex paths, which are later rewritten internally to /api/v1/responses. This rewriting happens after the authentication checks, allowing the attacker to bypass API-key verification and trick the server into making requests to upstream LLM providers using the operator's stored credentials. The impact ranges from data exposure to potential service disruption.

• CVE-2026-45549HIGH 8.5

  Roxy-WI, a web management tool for load balancers and web servers, contains a privilege escalation vulnerability in versions 8.2.6.4 and earlier. Any user logged into the system—even those with minimal "guest" privileges—can remotely start, stop, or restart the monitoring agent service on any server managed by Roxy-WI. Because the underlying systemd commands execute with root privileges, an attacker can disrupt critical infrastructure services or cause denial of service across your entire load-balanced environment. Authentication is required, but the lack of role or permission checks makes this a significant lateral movement and sabotage risk.

• CVE-2026-12411HIGH 8.4

  CVE-2026-12411 is a broken access control flaw in Canonical LXD's devLXDInstancePatchHandler that allows a guest container to access and modify storage volumes belonging to other guest containers. An attacker with local access to a container can send a specially crafted request through the /dev/lxd interface to read or overwrite another container's custom storage volume, but only when the security.devlxd.management.volumes feature is enabled. This breaks the isolation that containerization is designed to provide.

• CVE-2024-32949HIGH 8.3

  CVE-2024-32949 is a missing authorization flaw in the Prince Integrate Google Drive plugin that allows attackers to bypass access controls and perform unauthorized actions. An unauthenticated remote attacker can exploit misconfigured security levels to read data, make changes, or disrupt availability without needing valid credentials or user interaction. The vulnerability affects all versions of Integrate Google Drive up to and including 1.3.8.

• CVE-2025-2902HIGH 8.3

  Hitachi Virtual Storage Platform systems contain an authorization flaw in a maintenance utility that allows authenticated users to perform actions they should not be permitted to carry out. An attacker with valid credentials can exploit this weakness to make unauthorized changes to storage configurations or access sensitive data. The vulnerability requires an existing user account but no special privileges to trigger, making it a meaningful risk in environments where storage access is shared across teams or where former employees retain credentials.

• CVE-2026-11340HIGH 8.3

  HAVELSAN Inc.'s Liman MYS contains a missing authorization vulnerability that allows authenticated users to access functionality they should not have permission to reach. An attacker with valid login credentials can bypass access control lists (ACLs) to perform unauthorized actions, including modifying system data or disrupting availability. The vulnerability exists in versions prior to release.Master.1107.

• CVE-2026-32905HIGH 8.3

  OpenClaw versions before 2026.5.4 contain a flaw that lets users with basic chat access create device enrollment codes they shouldn't be able to generate. An attacker with legitimate chat permissions can issue bootstrap codes that add new devices with full operator and node-level capabilities to the system. Once enrolled, these devices retain administrative credentials indefinitely until an administrator manually removes them, creating a persistent backdoor.

• CVE-2026-46558HIGH 8.3

  Plane, an open-source project management platform, contains a critical authorization flaw that allows any logged-in user to access, modify, and delete files and assets stored in other workspaces they should not have permission to reach. This cross-workspace bypass persists in all versions prior to 1.3.1, making it a significant risk for organizations running multi-tenant Plane deployments where workspace isolation is expected to protect sensitive project data. The vulnerability requires authentication but no special privileges, meaning any team member can exploit it immediately.

• CVE-2026-54010HIGH 8.3

  Open WebUI, a self-hosted AI platform, contains a privilege escalation vulnerability that allows authenticated users to access files they should not have permission to read or delete. An attacker can attach file references to their own chat messages without validation, then share that chat to gain unauthorized access to those files. This affects versions prior to 0.9.6 and has been patched in the latest release.

• CVE-2026-27771HIGH 8.2

  Gitea, a self-hosted Git service, has a vulnerability that allows unauthenticated attackers to view sensitive information about private package sources used in Composer (a PHP dependency manager). An attacker can access details about internal or private package repositories without needing credentials, potentially exposing server names, URLs, and authentication tokens embedded in package configuration. This affects Gitea versions 1.26.1 and earlier.

• CVE-2026-42664HIGH 8.2

  A security flaw in Motive Commerce Search for WooCommerce (versions 1.38.2 and earlier) allows unauthenticated attackers to bypass access controls on the AI product search feature. This means someone without login credentials can perform actions they shouldn't be able to—specifically modifying data and disrupting service availability. The vulnerability requires no user interaction and can be exploited over the network, making it a significant risk for e-commerce sites relying on this plugin.

• CVE-2026-49065HIGH 8.2

  A critical security flaw has been identified in the Hippoo Mobile App for WooCommerce through version 1.9.5 that allows attackers to bypass authentication entirely and access sensitive information without credentials. An attacker can make requests directly to the app's backend without providing any login credentials, exposing customer data and potentially modifying content. This vulnerability requires no user interaction and can be exploited over the network from anywhere, making it a serious risk for any e-commerce operation using this app.

• CVE-2026-55188HIGH 8.2

  RustFS, a Rust-based distributed object storage system, has an authorization bypass flaw affecting versions 1.0.0-alpha.1 through 1.0.0-beta.8. An authenticated user—even one with minimal or no permissions—can query the bucket replication API to retrieve remote replication target configurations, including stored access credentials. This credential disclosure poses a direct risk to organizations relying on RustFS for sensitive data, as attackers gaining foothold access could pivot to compromise downstream replication infrastructure. The fix is available in version 1.0.0-beta.9 and later.

• CVE-2026-56104HIGH 8.2

  Chainlit versions before 2.10.1 have a session hijacking flaw that lets attackers with basic user access hijack authenticated sessions without the victim's knowledge. An attacker can steal a valid session ID and use it to impersonate a victim during WebSocket reconnection, gaining access to their data and the ability to run restricted tools. This requires the attacker to have some level of access to the system initially, but no additional authentication is needed once they have a session ID.

• CVE-2026-8377HIGH 8.2

  Armiya Information Technologies' Access Control System (GKS) contains a missing authorization flaw that allows unauthenticated attackers to extract sensitive data from shared resource locations. An attacker can remotely exploit this vulnerability without any special privileges or user interaction, gaining unauthorized access to confidential information stored in common system areas. The vulnerability affects GKS versions prior to Version 2.

• CVE-2026-35552HIGH 8.1

  CAXperts has released security advisories for two products affected by an authorization bypass vulnerability. If you're using UPVWebServices versions 2.4.2212.603 through 2.7.6 or UDiTH Portal versions 2026.0.0 through 2026.2.0, an authenticated user—even one without administrative privileges—can call a restricted API endpoint to deactivate your application's license. This doesn't require special tricks or user interaction; an attacker who has any valid login credential can exploit it immediately. The practical impact is service disruption: a disabled license typically renders the application inoperable.

• CVE-2026-47740HIGH 8.1

  Shopper is a headless e-commerce admin panel that manages orders and payments. Before version 2.8.0, the application had a critical permission bypass flaw: users with read-only access to orders could perform actions meant only for administrators with edit permissions. This included canceling orders, marking them as paid or complete, capturing payments from customer credit cards, and modifying shipment tracking. A low-privilege employee or attacker with basic read access could therefore manipulate any order's lifecycle and trigger real financial transactions without authorization.

• CVE-2026-49291HIGH 8.1

  mcp-memory-service, a semantic memory layer used in AI applications, contains an authorization flaw that allows attackers with read-only access to perform write operations. The vulnerability exists in the HTTP MCP JSON-RPC endpoint at `/mcp`, which fails to enforce proper permission checks when dispatching tool calls. Specifically, authenticated users granted only read-level OAuth scope can invoke the `store_memory` and `delete_memory` functions despite those operations being restricted to write-scope users at the REST API layer. This permission bypass enables unauthorized data modification in memory stores that should be protected.

• CVE-2026-49948HIGH 8.1

  Mem0 through version 0.2.8 has a privilege escalation vulnerability in its self-hosted server. Any user with an API key can reconfigure the global AI model and embedding providers to point to an attacker-controlled server. The attacker doesn't need elevated permissions—just normal API access. The malicious configuration persists in the database and survives restarts, affecting all users on that Mem0 instance. This allows the attacker to intercept, log, or manipulate all LLM requests and responses.

• CVE-2026-53866HIGH 8.1

  OpenClaw, a tool used by authenticated operators, has a flaw in how it processes shell commands. An attacker with valid credentials could bypass the system's approval controls and execute commands that should have been blocked. The issue stems from a parsing gap where certain command formats skip the required allowlist check, letting unauthorized shell commands run without triggering approval prompts.

• CVE-2026-54415HIGH 8.1

  Azuriom CMS versions before 1.2.11 contain a missing authorization flaw in server management routes that allows authenticated administrators with the admin.access permission to escalate privileges and take over regular user accounts. An attacker with admin credentials can create AzLink server tokens and use API endpoints to forcibly change user passwords and email addresses, effectively locking legitimate users out of their accounts and taking complete control of them.

• CVE-2026-54842HIGH 8.1

  A missing authorization vulnerability in Royal Plugins' Royal MCP allows users with low-level login credentials to perform sensitive actions they shouldn't be allowed to perform. An attacker with a valid standard user account can exploit incorrectly configured access controls to gain unauthorized capabilities. The vulnerability affects Royal MCP versions up to and including 1.4.25. While authentication is required to exploit this issue, the low barrier to entry—needing only basic user credentials—makes this a meaningful risk for organizations using this plugin.

• CVE-2026-55762HIGH 8.1

  Rocket.Chat versions before 8.5.1 (and earlier maintenance branches) contain a critical authorization flaw in their cloud registration API endpoint. While the endpoint requires a user to be logged in, it fails to verify that the user has permission to perform workspace-level administrative actions. Any regular user can exploit this by sending a single API call to permanently disconnect their organization's Rocket.Chat instance from the cloud, destroying cloud credentials, revoking licenses, and disabling push notifications for all employees. Recovery requires manual intervention and re-registration with Rocket.Chat Cloud.

• CVE-2026-58377HIGH 8.1

  JeecgBoot, a Java-based rapid application development framework, contains a critical flaw in how it controls access to API credential management. Low-privilege authenticated users can view, create, modify, and delete all OpenAPI credentials (API keys and secrets) without proper permission checks. This is particularly dangerous because the system returns secret keys in plaintext, allowing attackers to steal credentials and impersonate legitimate API clients.

• CVE-2026-59796HIGH 8.1

  JetBrains TeamCity versions before 2026.1.2 contain a flaw that allows authenticated users to modify CI/CD pipelines without proper authorization checks. An attacker with valid login credentials can bypass permission controls to alter pipeline configurations, potentially injecting malicious build steps, exfiltrating secrets, or compromising downstream deployments. This is a privilege escalation vulnerability affecting the integrity of your build and release process.

• CVE-2026-7368HIGH 8.1

  The Yarbo cloud platform lacks proper authorization controls, allowing any authenticated user—whether using shared credentials or legitimate accounts—to monitor all robots globally and send commands to any robot if they know its serial number. The serial number is routinely exposed in telemetry data, making it discoverable. This means a single compromised credential, even after hard-coded credentials are removed, grants an attacker complete control over an entire fleet of robots without per-device or per-user access restrictions.

• CVE-2025-48640HIGH 8.0

  CVE-2025-48640 is a privilege escalation vulnerability in Google Android where an attacker with local network proximity and low-level user privileges can bypass permission checks to approve third-party passkey pairings without the device owner's knowledge or action. This allows an attacker to gain elevated access to sensitive device functions and data.

• CVE-2026-15293HIGH 8.0

  The WP Business Intelligence Lite WordPress plugin contains a flaw that allows low-privileged users to bypass authorization controls and modify SQL queries. When an administrator views one of these tampered queries, it can execute arbitrary SQL code, potentially giving attackers administrative privileges. This affects all versions up to and including 3.2.0 and requires only Subscriber-level access to exploit.

• CVE-2026-35630HIGH 8.0

  OpenClaw versions before 2026.5.18 have an authorization bypass flaw in the QQBot approval workflow. Users who are not designated approvers can click approval buttons to authorize pending requests for code execution or plugin installations—permissions they should not have. An attacker with basic OpenClaw access could escalate their capabilities by approving requests they have no business approving, effectively bypassing the system's governance controls.

• CVE-2026-49367HIGH 8.0

  JetBrains IntelliJ IDEA contains a command execution vulnerability affecting versions before 2026.1.1. An authenticated user with guest-level privileges can execute arbitrary commands on the system where IntelliJ IDEA is running. The vulnerability requires user interaction but grants an attacker with low-privilege access the ability to perform high-impact actions, including reading sensitive files, modifying project code, or disrupting development environments.

• CVE-2025-26418HIGH 7.8

  A vulnerability in Android's device management system allows a local attacker with basic app permissions to bypass the user confirmation dialog that normally protects account additions on managed devices. This enables privilege escalation without requiring any special system access or user interaction. The flaw stems from a missing permission check in the CarDevicePolicyService component.

• CVE-2025-48617HIGH 7.8

  A permissions bypass vulnerability exists in Android's CarrierConfigLoader that allows an app with basic user-level access to escalate its privileges by circumventing UID validation checks. An attacker doesn't need special system permissions or user interaction to exploit this—just the ability to run code on the device with standard app-level rights. This means a malicious app could gain unauthorized access to sensitive functionality normally restricted to system components.

• CVE-2026-0071HIGH 7.8

  CVE-2026-0071 is a privilege escalation vulnerability in Android's SettingsLib component. A flaw in permission-checking logic allows a local attacker with basic user privileges to escalate to higher system permissions without needing to interact with the user or perform any additional actions. This is a logic error—not a memory corruption or injection flaw—making it a relatively straightforward vulnerability for attackers to exploit once they gain initial local access.

• CVE-2026-0081HIGH 7.8

  CVE-2026-0081 is a local privilege escalation flaw in Android's NFC (Near Field Communication) subsystem. An attacker with local access can forge NFC events by exploiting a missing permission check, allowing them to elevate their privileges without needing special system permissions or user interaction. This is a significant risk for multi-user or enterprise-managed Android devices where lateral movement or privilege abuse could unlock sensitive functionality.

• CVE-2026-0133HIGH 7.8

  CVE-2026-0133 is a local privilege escalation vulnerability in Android's ARM SMMU v3 driver. An attacker with limited user-level access can bypass a missing permission check to sign malicious Android Runtime bootclass artifacts, gaining elevated system privileges without needing special rights or user interaction. This is a kernel-level flaw that allows an unprivileged local user to escalate their permissions substantially.

• CVE-2026-28615HIGH 7.8

  CVE-2026-28615 is a local privilege escalation vulnerability in Google Android's Telecomm component that allows an attacker with limited user-level access to bypass permission checks and initiate unauthorized phone calls. The vulnerability requires no user interaction and no special execution privileges beyond standard app permissions, making it straightforward to exploit once an attacker gains initial device access.

• CVE-2026-42851HIGH 7.8

  Kitty is a popular GPU-accelerated terminal emulator that runs on multiple platforms. A critical design flaw in versions before 0.47.0 allows any untrusted content written to the terminal—such as text from a remote SSH session, a downloaded file, log output, or an email viewed in a pager—to execute arbitrary Python code within kitty's process space with the user's full privileges. This happens silently, with no warnings, permission dialogs, or user interaction required beyond the initial act of viewing the content. The vulnerability is especially dangerous because users often pipe untrusted data to their terminal without suspicion (e.g., viewing logs, reading downloaded files, or reviewing remote output).

• CVE-2026-6509HIGH 7.8

  Pardus Update, a software maintenance tool from TUBITAK BILGEM, contains a missing authorization check that allows an authenticated local user to escalate their privileges on affected systems. An attacker with basic user access can bypass intended permission controls to perform administrative actions without proper authorization, potentially gaining full system control.

• CVE-2026-14373HIGH 7.7

  HashiCorp Nomad has a flaw in how it enforces security restrictions on the Docker task driver. Specifically, Nomad failed to properly block authenticated users from launching containers that can access the host operating system's namespace and resources. An attacker with the ability to submit jobs to Nomad (a legitimate but restricted privilege) could exploit this to break container isolation, potentially reading sensitive data from the host or other workloads running on the same physical machine. The vulnerability affects both open-source and enterprise versions and has been patched.

• CVE-2026-46518HIGH 7.7

  OpenEMR versions before 8.0.0.1 contain a stored cross-site scripting (XSS) flaw in the prescription multi-print feature that allows a patient portal user to inject malicious code into a clinician's browser session. By manipulating patient demographic fields through the API, an attacker can execute arbitrary JavaScript when a clinician views prescription reports, potentially compromising the clinician's session and enabling unauthorized access to patient records or system actions.

• CVE-2026-49821HIGH 7.7

  Fission, a Kubernetes serverless framework, contained a namespace validation flaw in its Package controller prior to version 1.24.0. The buildermgr controller failed to verify that the environment namespace specified in a Package resource matched its actual namespace, potentially allowing authenticated users to reference functions or configurations from unintended namespaces. This cross-namespace access could expose sensitive data or functions, though it requires valid Kubernetes authentication to exploit. The issue is resolved in version 1.24.0 and later.

• CVE-2026-49822HIGH 7.7

  A vulnerability in Fission, an open-source serverless framework for Kubernetes, allows low-privilege developers to spy on activity in other namespaces. Specifically, a developer with limited access who can create a KubernetesWatchTrigger (KWT) in their own namespace can exploit this to establish unauthorized monitoring of unrelated namespaces. This violates namespace isolation, a core security boundary in Kubernetes. The issue has been patched in version 1.24.0.

• CVE-2026-54322HIGH 7.7

  Daytona, an infrastructure platform for AI code execution, contains an authorization bypass vulnerability in its role management system. An authenticated attacker who owns any organization can modify or delete roles that belong to a completely different organization. The vulnerability stems from the application checking whether the caller owns the organization in the URL path, but then operating on a role based solely on its ID without confirming that role belongs to the target organization. This allows privilege escalation and lateral damage across organization boundaries. The issue affects Daytona versions prior to 0.185.0.

• CVE-2026-55189HIGH 7.7

  RustFS, a distributed storage system, has a critical authorization bypass in its FTP interface. When FTP is enabled, users can read files and check file/bucket existence without proper permission checks—even if their account explicitly denies read access. The HTTP S3 interface is not affected. This vulnerability affects RustFS versions 1.0.0-alpha.1 through 1.0.0-beta.8 and is resolved in 1.0.0-beta.9.

• CVE-2026-59216HIGH 7.7

  Open WebUI versions before 0.10.0 contain a session hijacking vulnerability that allows authenticated users to execute Python code or invoke tools within another user's session. An attacker who discovers another user's Socket.IO session identifier through the ydoc:document:join event can leverage the get_event_call handler to run arbitrary code interpreter commands or tool invocations in that victim's context, bypassing the intended session isolation. The vulnerability requires authentication and user interaction, but succeeds because the server validates only that a session is connected, not that the requesting user owns it.

• CVE-2026-49374HIGH 7.6

  JetBrains TeamCity versions prior to 2026.1 suffer from insufficient permission checks that allow authenticated users to access sensitive build configuration parameters they should not be able to view. An attacker with valid login credentials but limited project access could extract confidential build settings, secrets, or other sensitive configuration data by exploiting this authorization flaw.

• CVE-2018-25391HIGH 7.5

  HaPe PKH 1.1 contains a critical authorization bypass flaw that allows anyone on the internet to delete administrative records without logging in or proving identity. An attacker can craft simple requests to remove administrator accounts and system updates by directly specifying which records to delete. The application fails to verify whether the requester has permission to perform these destructive actions, making it trivial to sabotage the system's core administrative functions.

• CVE-2025-69134HIGH 7.5

  A vulnerability in the OpenAI Chatbot for WordPress – Helper plugin (versions 1.1.4 and earlier) allows attackers to delete content from WordPress sites without needing to log in or provide any credentials. An attacker can remotely trigger deletion of arbitrary site content by sending specially crafted requests, potentially causing significant disruption to website availability and integrity.

• CVE-2026-10737HIGH 7.5

  The SP Project & Document Manager plugin for WordPress has a serious authorization flaw that allows anyone on the internet to download files from project folders without logging in. The vulnerability stems from a flawed permission check that uses logic errors to bypass all security gates. An attacker only needs to know or guess a file ID to request access through a standard WordPress admin interface, potentially exposing confidential project documents, contracts, customer data, or other sensitive files stored within the plugin.

• CVE-2026-11912HIGH 7.5

  The Simple File List WordPress plugin contains a critical flaw that allows unauthenticated attackers to delete or modify files on vulnerable servers. The vulnerability exists in all versions up to 6.3.7 and stems from a flawed authorization mechanism. Specifically, the code checks whether a request appears to come from an admin before evaluating the actual permission setting that controls file management features. This means attackers can bypass the intended security control even on installations where the administrator has explicitly disabled the file management feature.

• CVE-2026-1239HIGH 7.5

  Ninja Forms, a widely-used WordPress contact form plugin, has a critical flaw that allows anyone on the internet to access submitted form data without logging in. The vulnerability exists in the token refresh endpoint of the REST API, which fails to check whether a requester has permission before returning information. An attacker can view form submissions—including names, emails, phone numbers, and any custom fields—without credentials. This affects all versions up to 3.14.1.

• CVE-2026-13468HIGH 7.5

  The Visualizer plugin for WordPress—a tool that helps site owners create and embed charts and tables—has a serious flaw in its security. Anyone on the internet can access and download the raw data from any chart on an affected site, including charts that are supposed to be private, still in draft, or in the trash. The plugin is allowing this through a custom REST API endpoint that skips essential authorization checks that WordPress normally enforces. This is particularly problematic because the vulnerability contradicts how WordPress itself protects custom content types, creating a false sense of security if you've restricted who can view these charts through normal WordPress settings.

• CVE-2026-15291HIGH 7.5

  A WordPress plugin called Chat Help – Click to Chat Button & Form fails to verify that users making API requests are actually authorized to do so. This means anyone on the internet can send a simple request to the plugin's endpoints and retrieve sensitive customer data without needing a password or login credentials. The exposed information includes names, emails, phone numbers, chat messages, precise location details, browser fingerprints, and even WordPress user credentials. The vulnerability affects all versions up to 3.1.3.

• CVE-2026-26236HIGH 7.5

  A missing authorization vulnerability in QuMagie allows remote attackers to access data or perform actions they should not be permitted to do. The flaw does not require authentication, meaning an unauthenticated attacker on the network can exploit it directly. The vulnerability affects confidentiality but not integrity or availability. QNAP has patched the issue in QuMagie version 2.9.0 and later.

• CVE-2026-26237HIGH 7.5

  QuMagie, QNAP's media management application, contains a missing authorization vulnerability that allows remote attackers to access unauthorized data without requiring authentication. An attacker can exploit this flaw over the network to view or retrieve sensitive information stored within QuMagie installations. The vulnerability affects versions prior to 2.9.0 and has been patched in that release and later versions.

• CVE-2026-34898HIGH 7.5

  Event Tickets Manager for WooCommerce versions 1.5.3 and earlier contain an access control flaw that allows unauthenticated attackers to modify ticket data without permission. An attacker can interact with the plugin's API or administrative functions directly, bypassing the authentication requirement, and alter or delete event tickets. This affects any WooCommerce site running the vulnerable plugin version.

• CVE-2026-40741HIGH 7.5

  A critical access control flaw exists in Redsys for WooCommerce Light versions up to 7.0.0 that allows unauthenticated attackers to modify sensitive data without any form of authentication. The vulnerability does not require a login, special user role, or even interaction from a target user to exploit. An attacker can send a direct request to trigger the flaw and potentially alter order information, payment records, or other transaction data critical to e-commerce operations.

• CVE-2026-42669HIGH 7.5

  EventPrime versions through 4.3.2.0 contain a missing authorization vulnerability that allows unauthenticated attackers to modify data or perform actions they should not have access to. The flaw stems from improperly configured access control checks, meaning the application fails to verify user permissions before allowing sensitive operations. An attacker on the network can exploit this without credentials or user interaction, potentially altering event configurations, participant data, or other critical information depending on EventPrime's scope.

• CVE-2026-42670HIGH 7.5

  CVE-2026-42670 is a missing authorization flaw in Etoile Web Design Incorporated's Five Star Restaurant Reservations system. An attacker can access sensitive data by exploiting improperly configured access controls without needing credentials or user interaction. The vulnerability allows unauthenticated remote access to confidential information, presenting a direct risk to restaurant operations and customer data.

• CVE-2026-42677HIGH 7.5

  A missing authorization flaw in WP Document Revisions allows unauthenticated attackers to access sensitive documents by exploiting improperly configured security levels. The vulnerability affects how the plugin enforces access control rules, enabling unauthorized users to view confidential information stored within the WordPress environment.

• CVE-2026-47193HIGH 7.5

  OpenProject, a popular open-source project management platform, contains a vulnerability in its journal diff endpoint that leaks sensitive historical field values. The vulnerability exists because the endpoint does not properly check whether users should have access to view specific objects or fields before returning historical change data. An unauthenticated attacker can request historical project or task information that should remain hidden, potentially exposing sensitive business data, decisions, or field changes. The issue affects versions prior to 17.3.3 and 17.4.1.

• CVE-2026-48835HIGH 7.5

  A flaw in Contact Form by WPForms versions 1.10.0.4 and earlier allows attackers to bypass authentication and modify contact form data without permission. Because no login is required and the vulnerability is straightforward to trigger over the network, any attacker can exploit it. The flaw does not expose sensitive data directly, but enables unauthorized changes to form submissions and settings, disrupting business processes and data integrity.

• CVE-2026-48883HIGH 7.5

  A critical access control vulnerability exists in WPC Product Bundles for WooCommerce versions 8.5.3 and earlier. The plugin fails to properly validate user permissions, allowing unauthenticated attackers to modify product bundle configurations and pricing without authentication. This means an attacker could alter how bundles are presented to customers, change prices, or manipulate bundle contents—all without needing to log in or have any legitimate access to the store.

• CVE-2026-50108HIGH 7.5

  Naxclow's platform API contains a flaw that leaks persistent credentials used for device relay registration. An attacker who can craft a valid API request signature can retrieve relay credentials for any device—even devices they don't own—and impersonate that device on the relay network. This enables the attacker to intercept, monitor, or disrupt communications for compromised devices without needing to breach the device itself.

• CVE-2026-52799HIGH 7.5

  Gogs, a self-hosted Git service, contains an authorization bypass vulnerability affecting versions before 0.14.3. An attacker can download file attachments from private repositories without proper authentication or permission checks. The vulnerability exists because the endpoint serving attachments (GET /attachments/:uuid) does not validate whether the requester has access to the associated Issue, Comment, Release, or repository. In environments configured to allow unauthenticated access, this exposes sensitive attached files to unauthorized parties.

• CVE-2026-5356HIGH 7.5

  The LatePoint calendar booking plugin for WordPress contains a payment processing flaw that allows attackers to manipulate Stripe transactions without authentication. Specifically, the plugin accepts payment confirmation tokens directly from users rather than verifying them server-side, enabling someone to reuse a previously successful payment receipt to conduct unauthorized charges. This is a direct input validation failure that puts any WordPress site using the plugin at risk of financial fraud.

• CVE-2026-54475HIGH 7.5

  Apache ActiveMQ has a missing authorization vulnerability that breaks the isolation of temporary message destinations. These destinations are supposed to be private to each client connection, but the check exists only on the client side. An attacker with network access can bypass this by connecting directly to the broker and consuming messages from another connection's private temporary destination. This allows unauthorized message interception without requiring credentials or authentication bypass.

• CVE-2026-54695HIGH 7.5

  Pipecat is an open-source Python framework for building voice and AI agents. Versions before 1.4.0 expose an unauthenticated WebSocket endpoint used for development and testing that allows attackers to supply a call ID and trigger authenticated call-control commands (hang-up requests) to Twilio, Telnyx, and Plivo telephony providers using the server operator's own credentials. An attacker on the network can abuse this to disrupt active calls or perform unauthorized call terminations.

• CVE-2026-54810HIGH 7.5

  Nexi XPay, a payment processing platform, contains a missing authorization vulnerability that allows attackers to bypass access control mechanisms. An unauthenticated attacker on the network can exploit incorrectly configured security levels to gain unauthorized access to functions or data they should not reach, potentially causing service disruption. This is a network-accessible vulnerability requiring no user interaction or authentication to trigger.

• CVE-2026-54830HIGH 7.5

  Five Star Restaurant Reservations versions 2.7.19 and earlier contain an unauthenticated access control vulnerability that allows attackers to modify reservation data without logging in or providing credentials. An attacker can directly manipulate reservations—potentially altering bookings, canceling reservations, or disrupting restaurant operations—by sending crafted requests to the application. No authentication is required, and no user interaction is needed to exploit the flaw.

• CVE-2026-54835HIGH 7.5

  Five Star Restaurant Menu versions 2.5.2 and earlier contain a critical access control flaw that allows unauthenticated attackers to modify data through the application without providing credentials. An attacker on the network can directly change menu information, pricing, or other sensitive restaurant data without logging in, potentially disrupting operations or altering customer-facing information.

• CVE-2026-54837HIGH 7.5

  A critical access control flaw in Intranet & Private Site – All-In-One Intranet up to version 1.8.1 allows unauthenticated attackers to view sensitive information. The vulnerability stems from missing authorization checks, meaning someone without credentials can potentially access confidential data that should be restricted to authenticated users. The issue affects confidentiality but does not enable attackers to modify data or disrupt service.

• CVE-2026-54846HIGH 7.5

  A security flaw in Syncee Premium Dropshipping & Wholesale plugin (version 1.0.27 and earlier) allows unauthenticated attackers to access sensitive data without requiring login credentials or special permissions. The vulnerability stems from broken access controls that fail to properly verify user identity before exposing confidential information. While attackers cannot modify or delete data through this flaw, the unauthorized disclosure of information poses a significant confidentiality risk to users running affected versions.

• CVE-2026-56250HIGH 7.5

  Capgo before version 12.128.2 contains a flaw that allows attackers with upload-scoped API keys to weaponize the application's internal cleanup mechanisms. By modifying a field that controls where application bundles are stored, an attacker can point it to legitimate user data, then trigger automated deletion routines to destroy those objects. This is a targeted denial-of-service attack where the real damage happens through abuse of a legitimate maintenance function, not direct malicious code.

• CVE-2026-56279HIGH 7.5

  Capgo versions before 12.128.2 expose a critical information leak where anyone on the internet can request details about any user's organization memberships, roles, and billing information without logging in. The vulnerability exists in a backend function that should have been locked down but remains accessible to unauthenticated requests. An attacker only needs to guess or enumerate valid user IDs to harvest sensitive organizational data.

• CVE-2026-56341HIGH 7.5

  AVideo is a video platform software used by organizations to host and manage video content. Versions through 26.0 contain a critical flaw: several payment-related features expose sensitive financial data without requiring authentication. An attacker on the internet can request information from these vulnerable endpoints and receive complete payment records—including PayPal tokens, Authorize.Net webhook credentials, Bitcoin transaction details, and user financial information—simply by making direct HTTP requests. No login, no special tools, no complex attack chain required.