CVE-2026-68493Low· 3.1▾ SunlitAfter guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
0.1% → 0.2%
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85748High· 8.5mariadb: mariadb: use-after-free in SYS_REFCURSOR during FETCH operations (CVE-2026-85748)
CVE-2026-85745Medium· 4.3MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
CVE-2026-97380High· 8.8MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges
CVE-2026-77164Medium· 6.2Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF p…
CVE-2026-100688Medium· 6.5Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source c…
CVE-2026-77167High· 7.5Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table