Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 598

2 critical, 65 high, 73 medium, 31 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	High	7.1	CVE-2026-25716	Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock... Hallo Welt! GmbHHallo Welt! GmbH BlueSpice, Hallo Welt! GmbH BlueSpiceUserManager	NVD		Oct 23 09:17 UTC
CVE-2026-25716Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock... Executive summary A missing authorization flaw in the BlueSpice wiki user management extension (CVE-2026-25716) lets any logged-in user disable or re-enable accounts, including administrator accounts. The advisory rates this one High, and it is fixed in BlueSpice 5.1.11 and 5.2.7, which the vendor recommends installing. The same advisory also covers a critical flaw (CVE-2026-25784) that is fixed by the same 5.2.7 update. Technical summary The flaw is a missing authorization check (CWE-862) in the REST endpoints that Special:UserManager uses to block and unblock users, so any authenticated user can act on any account. The advisory says no content is changed and no data is disclosed, and that all block and unblock actions are logged in the block log. Affected versions are BlueSpice 5.0.0 – 5.1.10 and 5.2.0 – 5.2.6; fixed versions are BlueSpice 5.1.11 and BlueSpice 5.2.7, and the advisory says 5.0.x will not receive a fix. The advisory's workaround is to deny access to /rest.php/bs-usermanager/v1/block/create and /rest.php/bs-usermanager/v1/block/delete on the web server or reverse proxy, at the cost of disabling user enable/disable in Special:UserManager. The advisory does not state whether the issue is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from en.wiki.bluespice.com/wiki/Security:Sec…isories/BSSA-2026-07 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Hallo Welt! GmbH Hallo Welt! GmbH BlueSpice Hallo Welt! GmbH BlueSpiceUserManager NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee