Search
42 CVEs · published 2026-10-17 to 2026-10-17, High severity
CVEs (42)
Showing 1–25 of 42
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-111927 | HIGH | Patched | 7.7 | 2026-10-17 | Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname who… |
| CVE-2026-111924 | HIGH | Patched | 7.5 | 2026-10-17 | Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Att… |
| CVE-2026-111923 | HIGH | Patched | 7.5 | 2026-10-17 | Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. A… |
| CVE-2026-111922 | HIGH | Patched | 6.3 | 2026-10-17 | Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set… |
| CVE-2026-111919 | HIGH | Patched | 6.5 | 2026-10-17 | Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they crea… |
| CVE-2026-111917 | HIGH | Patched | 6.5 | 2026-10-17 | Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never ch… |
| CVE-2026-111914 | HIGH | Patched | 6.5 | 2026-10-17 | Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inven… |
| CVE-2026-111912 | HIGH | Patched | 6.5 | 2026-10-17 | Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other u… |
| CVE-2026-111910 | HIGH | Patched | 6.5 | 2026-10-17 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of re… |
| CVE-2026-111909 | HIGH | Patched | 8.1 | 2026-10-17 | phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to d… |
| CVE-2026-111908 | HIGH | Patched | 8.3 | 2026-10-17 | phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which che… |
| CVE-2026-111907 | HIGH | Patched | 7.1 | 2026-10-17 | phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without … |
| CVE-2026-111906 | HIGH | Patched | 6.5 | 2026-10-17 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints… |
| CVE-2026-111905 | HIGH | Patched | 6.0 | 2026-10-17 | phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns… |
| CVE-2026-111901 | HIGH | Patched | 7.5 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send … |
| CVE-2026-111898 | HIGH | Patched | 7.5 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username… |
| CVE-2026-111897 | HIGH | Patched | 7.1 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their ca… |
| CVE-2026-111895 | HIGH | Patched | 6.8 | 2026-10-17 | phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_u… |
| CVE-2026-111893 | HIGH | Patched | 6.5 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assig… |
| CVE-2026-111891 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints… |
| CVE-2026-111890 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions w… |
| CVE-2026-111886 | HIGH | Patched | 6.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP … |
| CVE-2026-111885 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target gro… |
| CVE-2026-111884 | HIGH | Patched | 8.3 | 2026-10-17 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::upd… |
| CVE-2026-111882 | HIGH | Patched | 8.1 | 2026-10-17 | phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-fac… |