Search
105 CVEs · published 2026-10-17 to 2026-10-17
CVEs (105)
Showing 1–25 of 105
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-105391 | NONE | — | 2026-10-17 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-107274 | NONE | — | 2026-10-17 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-107345 | NONE | — | 2026-10-17 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-107772 | NONE | — | 2026-10-17 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-108117 | NONE | — | 2026-10-17 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-111888 | MEDIUM | Patched | 2.7 | 2026-10-17 | phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /ad… |
| CVE-2026-111926 | MEDIUM | Patched | 3.3 | 2026-10-17 | Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including te… |
| CVE-2026-111932 | MEDIUM | Patched | 3.4 | 2026-10-17 | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and Lo… |
| CVE-2026-111933 | MEDIUM | Patched | 3.7 | 2026-10-17 | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitu… |
| CVE-2026-111934 | MEDIUM | Patched | 3.7 | 2026-10-17 | Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of … |
| CVE-2026-92431 | LOW | Patched | 3.7 | 2026-10-17 | The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of te… |
| CVE-2026-111602 | LOW | 3.7 | 2026-10-17 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,… | |
| CVE-2025-71435 | LOW | Patched | 4.2 | 2026-10-17 | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is iss… |
| CVE-2026-111931 | MEDIUM | Patched | 4.3 | 2026-10-17 | Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Pat… |
| CVE-2026-111930 | MEDIUM | Patched | 4.3 | 2026-10-17 | Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then f… |
| CVE-2026-111920 | MEDIUM | 4.3 | 2026-10-17 | Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the m… | |
| CVE-2026-111913 | MEDIUM | Patched | 4.3 | 2026-10-17 | Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mo… |
| CVE-2026-111900 | MEDIUM | Patched | 4.3 | 2026-10-17 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's pare… |
| CVE-2026-111889 | MEDIUM | Patched | 4.3 | 2026-10-17 | phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users wit… |
| CVE-2026-110882 | MEDIUM | 4.3 | 2026-10-17 | Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Se… | |
| CVE-2024-58398 | MEDIUM | Patched | 4.3 | 2026-10-17 | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is … |
| CVE-2026-92432 | MEDIUM | Patched | 4.3 | 2026-10-17 | The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitor… |
| CVE-2026-92715 | MEDIUM | Patched | 4.3 | 2026-10-17 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via … |
| CVE-2026-92978 | MEDIUM | 4.3 | 2026-10-17 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPres… | |
| CVE-2026-107763 | MEDIUM | 4.3 | 2026-10-17 | The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly veri… |