Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.1 HIGH
CVE-2026-92772 — Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketpla…

Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
7.1 HIGH
CVE-2026-92771 — Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRe…

Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
7.1 HIGH
CVE-2026-92770 — Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential…

Remote | Information Disclosure
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
7.1 HIGH
CVE-2026-92765 — ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList

ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can …

Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
5.3 MEDIUM
CVE-2026-92764 — OpenCVE before 3.1.0 Organization API Ignores Token Scope

OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens c…

Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
8.6 HIGH
CVE-2026-92763 — Rundeck through 6.2.1 Authorization Bypass via Project Import

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project …

Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
8.8 HIGH
CVE-2026-92762 — Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission c…

Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
8.8 HIGH
CVE-2026-92761 — WebVirtCloud Missing Authorization on Instance Control Actions

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines…

Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
7.1 HIGH
CVE-2026-92760 — Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-onl…

Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
7.1 HIGH
CVE-2026-92759 — SecObserve before 1.59.1 Information Disclosure via API Configuration

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses.…

Remote | Information Disclosure
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
5.3 MEDIUM
CVE-2026-92754 — PatrowlManager through 1.8.4 Improper Access Control via users API

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-pr…

patrowlmanager | Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
7.1 HIGH
CVE-2026-92753 — PatrowlManager through 1.8.4 Authorization Bypass via Events API

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event histo…

patrowlmanager | Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
8.7 HIGH
CVE-2026-92752 — metasfresh Unauthorized Access via Document Attachments and Comments Endpoints

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential …

Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
8.1 HIGH
CVE-2026-92751 — CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms …

Remote | Cross-Site Request Forgery
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
7.1 HIGH
CVE-2026-92750 — Harness through 3.3.0 Missing Access Control via infraproviders endpoint

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to.…

Remote | Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
9.2 CRITICAL
CVE-2026-92749 — SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attacker…

Remote | Cryptography
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
8.8 HIGH
CVE-2026-92748 — BC Security Empire before 6.7.1 Path Traversal File Upload RCE

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers …

Remote | Path Traversal
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
6.5 MEDIUM
CVE-2026-92527 — chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controller.rb of the component Shopify OAuth. The manipulation leads to server-side req…

Remote | Server-Side Request Forgery
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
6.3 MEDIUM
CVE-2026-81872 — OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emissio…

Remote | Denial of Service
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
6.3 MEDIUM
CVE-2026-81871 — OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTI…

Remote | Misconfiguration
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
Showing 20 of 14832 Results