Search
105 CVEs · published 2026-10-17 to 2026-10-17
CVEs (105)
Showing 26–50 of 105
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-111913 | MEDIUM | Patched | 4.3 | 2026-10-17 | Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mo… |
| CVE-2026-111912 | HIGH | Patched | 6.5 | 2026-10-17 | Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other u… |
| CVE-2026-111911 | CRITICAL | Patched | 9.8 | 2026-10-17 | phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication o… |
| CVE-2026-111910 | HIGH | Patched | 6.5 | 2026-10-17 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of re… |
| CVE-2026-111909 | HIGH | Patched | 8.1 | 2026-10-17 | phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to d… |
| CVE-2026-111908 | HIGH | Patched | 8.3 | 2026-10-17 | phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which che… |
| CVE-2026-111907 | HIGH | Patched | 7.1 | 2026-10-17 | phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without … |
| CVE-2026-111906 | HIGH | Patched | 6.5 | 2026-10-17 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints… |
| CVE-2026-111905 | HIGH | Patched | 6.0 | 2026-10-17 | phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns… |
| CVE-2026-111904 | MEDIUM | Patched | 5.3 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an invert… |
| CVE-2026-111903 | MEDIUM | Patched | 5.4 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitizatio… |
| CVE-2026-111902 | MEDIUM | Patched | 5.3 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauth… |
| CVE-2026-111901 | HIGH | Patched | 7.5 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send … |
| CVE-2026-111900 | MEDIUM | Patched | 4.3 | 2026-10-17 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's pare… |
| CVE-2026-111898 | HIGH | Patched | 7.5 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username… |
| CVE-2026-111897 | HIGH | Patched | 7.1 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their ca… |
| CVE-2026-111896 | MEDIUM | Patched | 5.4 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Atta… |
| CVE-2026-111895 | HIGH | Patched | 6.8 | 2026-10-17 | phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_u… |
| CVE-2026-111894 | MEDIUM | Patched | 5.4 | 2026-10-17 | phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaS… |
| CVE-2026-111893 | HIGH | Patched | 6.5 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assig… |
| CVE-2026-111892 | MEDIUM | Patched | 6.5 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attacker… |
| CVE-2026-111891 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints… |
| CVE-2026-111890 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions w… |
| CVE-2026-111889 | MEDIUM | Patched | 4.3 | 2026-10-17 | phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users wit… |
| CVE-2026-111888 | MEDIUM | Patched | 2.7 | 2026-10-17 | phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /ad… |