Export limit exceeded: 420285 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16491 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-33379 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-11-06 | 8.5 High |
| A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not. | ||||
| CVE-2026-88800 | 2026-11-06 | 9.1 Critical | ||
| The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities. | ||||
| CVE-2026-119259 | 2026-11-06 | 5.3 Medium | ||
| The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit. | ||||
| CVE-2026-118186 | 2026-11-06 | 4.9 Medium | ||
| The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow. | ||||
| CVE-2026-118167 | 2026-11-06 | 5.3 Medium | ||
| The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account. | ||||
| CVE-2026-123327 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.5 High |
| In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions | ||||
| CVE-2026-123333 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.8 Low |
| In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints | ||||
| CVE-2026-123324 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.7 High |
| In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible | ||||
| CVE-2026-123326 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.1 High |
| In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension | ||||
| CVE-2026-123328 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 6.4 Medium |
| In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab | ||||
| CVE-2026-123332 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 4.7 Medium |
| In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations | ||||
| CVE-2026-123300 | 2026-11-06 | 2.7 Low | ||
| In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings | ||||
| CVE-2026-123279 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 9 Critical |
| In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators | ||||
| CVE-2026-123280 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 8.1 High |
| In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports | ||||
| CVE-2026-123284 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 6.5 Medium |
| In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content | ||||
| CVE-2026-123286 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.9 Medium |
| In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token | ||||
| CVE-2026-123287 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.9 Medium |
| In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports | ||||
| CVE-2026-123655 | 2026-11-06 | 7.5 High | ||
| A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content. | ||||
| CVE-2026-123331 | 2026-11-06 | 5.4 Medium | ||
| In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles | ||||
| CVE-2026-123334 | 2026-11-06 | 3.8 Low | ||
| In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project | ||||