Каталоги
В сервис интегрированы наиболее популярные публичных базы знаний:
- Сертификаты СЗИ - Государственный реестр сертифицированных средств защиты информации опубликованный Федеральной службой по техническому и экспортному контролю, может быть использован для контроля актуальности используемых СЗИ в организации.
- CWE уязвимости - общедоступная публичная база распространенных типов уязвимостей в программном и аппаратном обеспечении, которые могут иметь последствия для безопасности - Common weakness enumeration.
- CVE уязвимости - общедоступная публичная база уязвимостей Common Vulnerabilities and Exposures (CVE). Миссия программы CVE заключается в выявлении, определении и каталогизации публично раскрываемых уязвимостей в сфере кибербезопасности. Для каждой уязвимости в каталоге существует одна запись CVE. Уязвимости обнаруживаются, затем присваиваются и публикуются организациями по всему миру, которые сотрудничают с программой CVE. Партнеры публикуют записи CVE для единообразного описания уязвимостей. Специалисты в области информационных технологий и кибербезопасности используют записи CVE, чтобы убедиться, что они обсуждают одну и ту же проблему, и координировать свои усилия по определению приоритетности и устранению уязвимостей.
- БДУ ФСТЭК уязвимости - раздел Уязвимости Банка данных уязвимостей опубликованная Федеральной службой по техническому и экспортному контролю совместно с Государственным научно-исследовательским испытательным институтом проблем технической защиты информации. Одной из целей создания банка данных угроз безопасности информации является объединение специалистов в области информационной безопасности для решения задач повышения защищенности информационных систем.
- НКЦКИ уязвимости - общедоступная публичная база уязвимостей Национального координационного центра по компьютерным инцидентам (НКЦКИ), обеспечивающего координацию деятельности субъектов КИИ по обнаружению, предупреждению, ликвидации последствий компьютерных атак и реагированию на компьютерные инциденты.
- MITRE ATT&CK – Adversarial Tactics, Techniques & Common Knowledge – Тактики, техники и общеизвестные знания о злоумышленниках. Это основанная на реальных наблюдениях база знаний компании Mitre, содержащая описание тактик, приемов и методов, используемых киберпреступниками. База создана в 2013 году и регулярно обновляется, цель – составление структурированной матрицы используемых киберпреступниками приемов, чтобы упростить задачу реагирования на киберинциденты.
- БДУ ФСТЭК и Новая БДУ ФСТЭК – раздел Угрозы Банка данных угроз, опубликованный в 2015 году Федеральной службой по техническому и экспортному контролю и Государственным научно-исследовательским испытательным институтом проблем технической защиты информации, обязателен при моделировании угроз при построении систем защиты персональных данных, критической информационной инфраструктуры, государственных информационных систем.
- Exploits & Shellcodes - база данных эксплойтов поддерживается OffSec, обучающей компанией по информационной безопасности, которая предоставляет различные сертификаты по информационной безопасности, а также услуги по тестированию на проникновение высокого класса.
Каталог Справка открывает раздел документации по каталогам.
Уязвимости CVE, БДУ ФСТЭК и НКЦКИ
Каталоги CVE уязвимости, БДУ ФСТЭК уязвимости и НКЦКИ уязвимости предоставляют дополнительный контент и обогащают информацией описание уязвимостей от сканеров в модуле Технические уязвимости.
Интерфейс каталогов идентичен и содержит следующие блоки:
- Метрики:
- Найденные уязвимости – отображает количество найденных в отчетах от сканеров уязвимостей которые связаны с уязвимостями из каталога, при нажатии на виджет перенаправляет в модуль Технические уязвимости с установленным фильтром по названию каталога (тип фильтра Группа уязвимостей);
- Уязвимые хосты – отображает количество хостов на которых обнаружены уязвимости связанные с уязвимостями из каталога, при нажатии на виджет перенаправляет в модуль Технические уязвимости с установленным фильтром по названию каталога (тип фильтра Группа уязвимостей).
- Табличную часть Каталог уязвимостей:
- Фильтр по полю Идентификатор - особенностью данного фильтра является автоматический разбор текста с последующим извлечением из текста идентификаторов. Для этого необходимо вставить произвольный текст с идентификаторами в поле и добавить в фильтр через кнопку плюс;
- Табличную часть с полями для каталогов CVE и БДУ ФСТЭК:
- Идентификатор - id уязвимости в базе уязвимостей;
- Описание - текстовое описание уязвимости;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- CVSS - числовая оценка уязвимости согласно источнику, с указанием даты выявления уязвимости экспертами, оценка отображается цветом согласно оценке CVSS 0.1 – 3.9 Low Зеленый,
4.0 – 6.9 Medium Желтый, 7.0 – 8.9 High Оранжевый, 9.0 – 10.0 Critical Красный.
- Табличную часть с полями для каталогов CVE :
- Дата бюллетеня - информация о дате публикации бюллетеня содержащего уязвимости;
- Идентификатор - id уязвимости в базе уязвимостей;
- Информация - текстовое описание уязвимости;
- Вектор атаки - локальный или сетевой вектор атаки;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Наличие обновления - - флаг, данный статус отображается если база уязвимостей содержит информацию о наличии обновлений от производителя уязвимого ПО;
- Дата выявления - даты выявления уязвимости экспертами.
- Чекбокс «Только обнаруженные уязвимости» - устанавливает фильтр на табличную часть для отображения только обнаруженные уязвимости.
- Функционал для экспорта всех уязвимостей каталога.
- Для каталога добавляется функционал Варианты отображения:
- Бюллетени - изменяет отображение табличной части на реестр бюллетеней, отображает общее количество уязвимостей в бюллетени в поле Уязвимостей в бюллетени и статус по обнаружению в поле Обнаружено - данный статус отображается если хотя бы одна уязвимость из бюллетеня обнаружена в инфраструктуре.
- Уязвимости.
Каталог Exploits & Shellcodes
Каталог используется для обогащения информацией карточек уязвимостей. Каталог хранит описания готовых скриптов и кода, для эксплуатации уязвимостей, из публичного источника Exploit-DB. В карточке эксплойта отображаются все атрибуты, блоки связанные с каталогами уязвимостей CVE, БДУ, НКЦКИ, CWE.
Интерфейс каталогов идентичен и содержит следующие блоки:
Табличную часть Каталог уязвимостей:
Интерфейс каталогов идентичен и содержит следующие блоки:
Табличную часть Каталог уязвимостей:
- Фильтр по типу (exploit или shellcode);
- Фильтр по полю Платформа;
- Чекбокс «Только проверенные» - устанавливает фильтр на табличную часть для отображения только проверенных уязвимостей.
Табличную часть с полями:
- Идентификатор - id уязвимости в базе уязвимостей;
- Тип - к какому типу относится уязвимость Exploit / Shellcode;
- Описание - текстовое описание уязвимости;
- Платформа - на каких платформах проявляется;
- Дата публикации - информация о дате публикации;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Проверено - флаг, данный статус отображается если уязвимость является проверенной.
MITRE ATT&CK, БДУ ФСТЭК, Новая БДУ ФСТЭК
Данные из каталогов MITRE ATT&CK, БДУ ФСТЭК, Новая БДУ ФСТЭК могут использоваться для контекстного наполнения риска в модуле Риски.
Каждый из указанных каталогов сформирован по собственной схеме данных, которая не соответствует подходу оценки риска, используемому в сервисе. Но в основе своей указанные базы описывают все те же риски информационной безопасности, каждый под своим углом. Поэтому они добавлены в сервис и как отдельные компоненты и как основа для создания рисков, угроз или уязвимостей.
Каталоги могут использоваться в сервисе с целью:
- Облегчения процесса формирования рисков, угроз и уязвимостей;
- Обогащения информации по рискам (угрозам, уязвимостям) созданным в сервисе.
- Взгляда на компанию и оценку рисков через публичные каталоги угроз.
Сервис позволяет установить связь между объектами из каталогов и 3 типами объектов сервиса: угрозами, уязвимостями или рисками безопасности:
- Уязвимости могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK и способами реализации Новой БДУ ФСТЭК.
- Угрозы могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK, угрозами и последствиями Новой БДУ ФСТЭК.
- Риски могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK, угрозами, способами реализации и последствиями Новой БДУ ФСТЭК.
Такой широкий выбор возможных связей сделан потому, что объекты из каталогов угроз могут быть или угрозой или уязвимостью в контексте сервиса.
Например, УБИ.004 Угроза аппаратного сброса пароля BIOS из БДУ ФСТЭК в контексте сервиса является уязвимостью, особенностью активов типа Микропрограммное обеспечение, которая может привести к реализации угрозы Несанкционированного локального доступа к BIOS.
В большинстве случаев угрозы из БДУ ФСТЭК и техники из MITRE ATT@CK являются именно уязвимостями, использование которых ведет к реализации угроз безопасности, но бывают и исключения.
Для рисков, угроз и уязвимостей из базы Community связи с каталогами угроз уже установлены.
Связь с каталогом угроз может быть прямой или косвенной. Например, если уязвимость связана с угрозой из БДУ ФСТЭК то и все риски, в составе которых есть данная уязвимость будут автоматически связаны с угрозой из БДУ ФСТЭК.
Каталог БДУ ФСТЭК - это реестр рисков от банка данных угроз безопасности информации ФСТЭК России.
Каждая угроза содержит описание, рекомендации к каким типам активов может быть применена эта угроза, классификация по свойствам информации и вероятные источники угрозы. Дополнительно в блоке Связанные риски указаны связанные риски, а в блоке Каталоги указываются связи с записями из других каталогов.
Каталог Новая БДУ ФСТЭК от банка данных угроз безопасности информации ФСТЭК России содержит:
- матрицу Способы реализации (возникновения угроз) - каждая ячейка которых содержит описание поверхности атаки: группу способов, уровень возможностей нарушителя, возможные реализуемые угрозы, компоненты объектов воздействия, возможные меры защиты;
- Негативные последствия - перечень негативных последствий в классификации ФСТЭК в виде кода и описания;
- Угрозы - реестр угроз с описанием, каждая угроза содержит возможные объекты воздействия и возможные способы реализации угроз;
- Объекты - перечень объектов последствий с описанием и компонентами которые могут входить в состав объекта;
- Компоненты - перечень компонентов объектов воздействия с указанием объектов воздействия на которых они могут располагаться;
- Нарушители - уровни возможностей нарушителей классифицированные по возможностям и компетенции;
- Меры защиты - в терминологии SECURITM это список требований выполнение которых сокращает возможности нарушителя.
Каталог MITRE ATT&CK содержит:
- Матрица - содержит тактики и техники злоумышленника, позволяет на основании тактики или техники создать риск или уязвимость, в матрице указаны связи с рисками в базе Community и с рисками в базе команды;
- Тактики - направления действия нарушителя на том или ином этапе cyberkillchane;
- Техники - конкретные действия нарушителя для достижения цели на конкретном шаге cyberkillchane;
- Контрмеры - в терминологии SECURITM это список требований выполнение которых сокращает возможности нарушителя;
- Преступные группы - описание APT группировок и их особенности и модель поведения;
- Инструменты - ПО используемое нарушителями для вредоносного воздействия.
Матрицы могут использоваться для построения тепловой карты рисков наложенных на матрицы угроз и уязвимостей.
Уязвимости CWE
Каталог CWE уязвимости предоставляет дополнительный контент и обогащают информацией описание уязвимостей от сканеров в модуле Технические уязвимости.
Интерфейс каталогов идентичен и содержит следующие блоки:
- Табличную часть Каталог уязвимостей:
- Фильтр по полю Идентификатор;
- Табличную часть с полями:
- Идентификатор - id уязвимости в базе уязвимостей;
- Имя - текстовое описание уязвимости;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Чекбокс «Только обнаруженные уязвимости» - устанавливает фильтр на табличную часть для отображения только обнаруженные уязвимости.
Сертификаты СЗИ
Каталог Сертификаты СЗИ может быть использован в модуле Активы как источник информации для поля Номер сертификата СЗИ. В модуле активов есть возможность вести реестр СЗИ используемых в организации, в свою очередь каталог сертификатов СЗИ позволяет связать актив с каталогом через поле актива Номер сертификата СЗИ.
Каталог Сертификаты СЗИ содержит реестр с информацией о номере сертификата, сроке действия сертификата и сроке поддержки СЗИ. Кроме реестра каталог содержит следующие метрики:
- Имеющиеся СЗИ - отображает количество активов у которых заполнено поле Номер сертификата СЗИ;
- Скоро будут просрочены - отображает количество активов у которых срок действия сертификата меньше 90 календарных дней;
- Просроченные сертификаты - отображает количество активов у которых срок действия сертификата уже истек;
- Истекшая поддержка - отображает количество активов у которых срок действия сертификата уже истек.
Каждая метрика ведёт в реестр активов и выводит список СЗИ, отфильтрованный по соответствующим параметрам.
Нажав на просмотр сертификата, мы увидим карточку сертификата, сервис хранит информацию о следующих данных:
- Номер сертификата;
- Дата внесения в реестр;
- Срок действия сертификата;
- Срок окончания тех. поддержки;
- Наименование средства (шифр);
- Схема сертификации;
- Испытательная лаборатория;
- Орган по сертификации;
- Заявитель;
- Наименования документов соответствия;
- Реквизиты заявителя.
Реестр обновляется автоматически один раз в месяц.
При выборе или изменении значения поля Номер сертификата СЗИ в карточке актива связанные поля заполняются автоматически из данных сертификата: проставляется признак Сертифицировано, а также срок действия сертификата и срок окончания технической поддержки. При очистке поля Номер сертификата СЗИ эти поля очищаются. Заполнение происходит автоматически, отдельно вносить эти значения вручную не требуется.
При выборе или изменении значения поля Номер сертификата СЗИ в карточке актива связанные поля заполняются автоматически из данных сертификата: проставляется признак Сертифицировано, а также срок действия сертификата и срок окончания технической поддержки. При очистке поля Номер сертификата СЗИ эти поля очищаются. Заполнение происходит автоматически, отдельно вносить эти значения вручную не требуется.
Куда я попал?
CWE-862
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
| Тип уязвимости: | Не зависит от других уязвимостей |
| Вероятность эксплойта: |
High
|
Идентификаторы ФСТЭК уязвимостей
Идентификатор, базы данных общеизвестных уязвимостей информационной безопасности
| Идентификатор | Описание |
|---|---|
| BDU:2014-00033 | Уязвимость операционной системы Cisco IOS, позволяющая злоумышленнику повысить привилегии и выполнять произвольный код |
| BDU:2018-00869 | Уязвимость функции browser.identity.launchWebAuthFlow расширения WebExtensions браузера Mozilla Firefox, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2019-03693 | Уязвимость подсистемы UDF систем управления базами данных "Ред База Данных" и Firebird, позволяющая нарушителю выполнить произвольный код |
| BDU:2019-03811 | Уязвимость централизованной службы для поддержки информации о конфигурации, именования, обеспечения распределенной синхронизации и предоставления групповых служб Apache ZooKeeper, позволяющая нарушителю записать произвольные файлы в операционной сист... |
| BDU:2019-04342 | Уязвимость набора инструментов DevTools браузера Google Chrome, позволяющая нарушителю получить несанкционированный доступ к локальным файлам |
| BDU:2020-00045 | Уязвимость программного обеспечения для интеграции корпоративных приложений SAP NetWeaver Process Integration, связанная с ошибками авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2020-00569 | Уязвимость программного обеспечения SAP Leasing, связанная с ошибками авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2020-00804 | Уязвимость службы keystore программной интеграционной платформы SAP NetWeaver, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2020-00886 | Уязвимость веб-интерфейса администрирования платформы управления политиками соединений Cisco Identity Services Engine, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2020-01324 | Уязвимость функции base_sock_create из drivers/isdn/mISDN/socket.c модуля AF_ISDN ядра операционной системы Linux, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю оказать воздействие на целостность данных |
| BDU:2020-01488 | Уязвимость компонента arch/powerpc/kernel/process.c ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации |
| BDU:2020-02043 | Уязвимость системы ввода для записи нескольких языков в Unix-подобных операционных системах ibus, позволяющая нарушителю получить несанкционированный доступ к информации и нарушить ее целостность |
| BDU:2020-03122 | Уязвимость программного средства администрирования лицензий Cisco Smart Software Manager On-Prem, связанная с недостатками контроля доступа, позволяющая нарушителю создавать произвольные учетные записи пользователей |
| BDU:2020-04370 | Уязвимость компонента Windows Mobile Device Management (MDM) Diagnostics операционных систем Windows, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2020-04607 | Уязвимость веб-интерфейса операционной системы Cisco IOS XE, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код |
| BDU:2020-04947 | Уязвимость компонента "file transfer" сервера TIBCO Managed File Transfer Platform Server, позволяющая нарушителю изменить произвольные файлы |
| BDU:2020-05604 | Уязвимость обработчика PDF-содержимого PDFium веб-браузера Google Chrome, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2020-05613 | Уязвимость компонента Networking веб-браузера Google Chrome, позволяющая нарушителю повысить свои привилегии |
| BDU:2020-05638 | Уязвимость микропрограммного обеспечения модульного контроллера для автоматизации трансформаторных подстанций Schneider Electric Easergy T300 модуля SC150, связанная с некорректной авторизацией пользователей, позволяющая нарушителю просматривать и из... |
| BDU:2020-05760 | Уязвимость программного средства управления персоналом SAP ERP HCM, связанная с отсутствием авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2020-05790 | Уязвимость платформы бизнес-аналитики SAP Business Objects Business Intelligence Platform, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю провести XSS-атаки |
| BDU:2021-00082 | Уязвимость компонента "ALTER ... DEPENDS ON EXTENSION" системы управления базами данных PostgreSQL, позволяющая нарушителю оказать воздействие на целостность данных |
| BDU:2021-00360 | Уязвимость функции browser.tabs.executeScript () расширения WebExtensions браузера Mozilla Firefox, позволяющая нарушителю проводить межсайтовые сценарные атаки |
| BDU:2021-01247 | Уязвимость микропрограммного обеспечения маршрутизатора ZyXEL P-1302-T10 v3, связанная с недостатками защиты служебных данных, позволяющая нарушителю повысить свои привилегии |
| BDU:2021-01448 | Уязвимость функции recv_files в receiver.c утилиты для передачи и синхронизации файлов Rsync, позволяющая нарушителю оказать воздействие на целостность данных |
| BDU:2021-01776 | Уязвимость компонента scan.c VNC-сервера X11vnc, связанная с отсутствием механизма авторизации, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании |
| BDU:2021-02168 | Уязвимость компонента Generic Market Data программного средства автоматизация банковской деятельности SAP Banking Services, позволяющая нарушителю оказать воздействие на целостность и раскрыть защищаемую информацию |
| BDU:2021-03168 | Уязвимость функции ContentModelChange программного средства для реализации гипертекстовой среды MediaWiki, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2021-03300 | Уязвимость компонента shared/view_source.php программного обеспечения для управления медицинскими записями OpenClinic, позволяющая нарушителю выполнить произвольный код |
| BDU:2021-03443 | Уязвимость компонента RTAS ядра операционной системы Linux, связанная с отсутствием механизма авторизации, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании |
| BDU:2021-04000 | Уязвимость сетевого сервиса Ehcache RMI программных продуктов для обработки данных Jira Data Center, Jira Core Data Center, Jira Software Data Center, позволяющая нарушителю выполнить произвольный код |
| BDU:2021-04237 | Уязвимость функций notifyProfileAdded и notifyProfileRemoved операционной системы Android, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2021-04582 | Уязвимость компонента proxy65 сервера для Jabber/XMPP Prosody, связанная с отсутствием механизма авторизации, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2021-04592 | Уязвимость библиотеки управления виртуализацией Libvirt, связанная с ошибками авторизации, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2021-04656 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с ошибками авторизации, позволяющая нарушителю оказать воздействие на целостность данных |
| BDU:2021-04813 | Уязвимость контроллера доставки приложений Citrix ADC (ранее Citrix NetScaler Application Delivery Controller), системы контроля доступа к виртуальной среде Citrix Gateway (ранее Citrix NetScaler Gateway) и программного средства управления сетью Citr... |
| BDU:2021-04975 | Уязвимость службы JMS Connector Service сервера веб-приложений SAP NetWeaver Java Application Server, позволяющая нарушителю обойти существующие ограничения безопасности или выполнить произвольный код |
| BDU:2021-06095 | Уязвимость компонента cgi-bin/upload_firmware.cgi микропрограммного обеспечения маршрутизатора D-Link DIR-823G, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2021-06110 | Уязвимость сервера автоматизации Jenkins, связанная с отсутствием процедуры авторизации, позволяющая нарушителю создать родительские каталоги в FilePathmkdirs |
| BDU:2021-06207 | Уязвимость интерфейса J-Web операционных систем Junos OS, позволяющая нарушителю обойти ограничения безопасности |
| BDU:2021-06221 | Уязвимость компонента FilePathlistFiles сервера автоматизации Jenkins, связанная с отсутствием процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации |
| BDU:2021-06222 | Уязвимость компонента FilePathreading(FileVisitor) сервера автоматизации Jenkins, позволяющая нарушителю иметь неограниченный доступ для чтения файлов с использованием определенных операций |
| BDU:2021-06271 | Уязвимость сервера автоматизации Jenkins, связанная с отсутствием процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации |
| BDU:2021-06323 | Уязвимость микропрограммного обеспечения Ethernet модулей WISE-4060 и Adam-6050 D, связанная с недостатками процедуры проверок ввода текущего пароля, позволяющая нарушителю получить полный доступ к устройству с привилегии администратора |
| BDU:2022-00040 | Уязвимость сервера автоматизации Jenkins, связанная с отсутствием процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации |
| BDU:2022-00173 | Уязвимость демона 1905 микропрограммного обеспечения микросхем MediaTek МТ7603Е, МТ7613, МТ7615, МТ7622, МТ7628, МТ7629, МТ7915, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2022-00682 | Уязвимость подсистемы виртуализации KVM ядра операционной системы Linux, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии |
| BDU:2022-00683 | Уязвимость ядра операционной системы Linux, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии |
| BDU:2022-00879 | Уязвимость универсальной системы мониторинга Zabbix , связанная с ошибками авторизации, позволяющая нарушителю выполнить произвольный код с root-привилегиями |
| BDU:2022-01056 | Уязвимость программного обеспечения Apache ShenYu, связанная с отсутствием авторизации для критичной функции, позволяющая нарушителю обойти введенные ограничения безопасности |
| BDU:2022-01057 | Уязвимость программного обеспечения Apache ShenYu, связанная с отсутствием авторизации для критичной функции, позволяющая нарушителю обойти введенные ограничения безопасности |
| BDU:2022-01781 | Уязвимость компонента net/http/httputil языка программирования Golang, позволяющая нарушителю оказать воздействие на целостность данных |
| BDU:2022-02440 | Уязвимость веб-сервера Atlassian Confluence Server, связанная с ошибками авторизации, позволяющая нарушителю читать произвольные файлы |
| BDU:2022-02482 | Уязвимость веб-интерфейса микропрограммного обеспечения маршрутизаторов Cisco Small Business RV340, RV340W, RV345, RV345P, позволяющая нарушителю повысить свои привилегии до уровня root |
| BDU:2022-03004 | Уязвимость системного вызова PTRACE_SEIZE безопасного режима вычислений seccomp ядра операционной системы Linux, позволяющая нарушителю повысить свои привилегии |
| BDU:2022-03018 | Уязвимость службы хостинга RubyGems.org, связанная с ошибками авторизации, позволяющая нарушителю получить доступ на создание, изменение или удаление данных |
| BDU:2022-04059 | Уязвимость веб-интерфейса управления программного обеспечения контроллера Cisco AppDynamics Controller, позволяющая нарушителю раскрыть защищаемую информацию и повысить свои привилегии |
| BDU:2022-04234 | Уязвимость приложения создания фотоальбомов Video Station, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2022-04332 | Уязвимость сервера TUG Home Base Server, связанная с недостатками процедуры авторизации, позволяющая нарушителю добавлять и удалять произвольных пользователей |
| BDU:2022-04333 | Уязвимость сервера TUG Home Base Server, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к хэшированным учетным данным |
| BDU:2022-04364 | Уязвимость микропрограммного обеспечения удаленных терминалов Siemens SICAM, связанная с недостатками процедуры авторизации, позволяющая нарушителю читать произвольные файлы |
| BDU:2022-04841 | Уязвимость плагина Jenkins Buckminster Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04842 | Уязвимость плагина Jenkins Lucene-Search Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04844 | Уязвимость плагина Jenkins Openstack Heat Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04845 | Уязвимость плагинаJenkins Openstack Heat Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю совершить подмену URL-адреса |
| BDU:2022-04846 | Уязвимость плагина Jenkins Google Cloud Backup Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю копировать произвольные файлы |
| BDU:2022-04847 | Уязвимость плагина Jenkins Files Found Trigger Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04849 | Уязвимость плагина Jenkins Coverity Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04853 | Уязвимость плагина Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04855 | Уязвимость плагина Jenkins Coverity Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04858 | Уязвимость плагина Jenkins OpenShift Deployer Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04860 | Уязвимость плагина Jenkins Repository Connector Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю раскрыть информацию об идентификаторах учетных данных |
| BDU:2022-04864 | Уязвимость плагина Jenkins Deployer Framework Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04866 | Уязвимость плагина Jenkins Compuware Xpediter Code Coverage Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04867 | Уязвимость плагина Jenkins Compuware ISPW Operations Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04868 | Уязвимость плагина Jenkins rhnpush-plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04869 | Уязвимость плагина Jenkins HashiCorp Vault Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04871 | Уязвимость плагина Jenkins Repository Connector Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю раскрыть защищаемую информацию о файловой системе |
| BDU:2022-04874 | Уязвимость плагина Jenkins rpmsign-plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04875 | Уязвимость плагина Jenkins Compuware Topaz Utilities Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-04939 | Уязвимость платформы SAP Enable Now Manager, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и нарушить её целостность |
| BDU:2022-05210 | Уязвимость функции Uninstall Protection программного средства защиты конечных точек Crowdstrike Falcon, позволяющая нарушителю удалить программное обеспечение CrowdStrike |
| BDU:2022-05213 | Уязвимость программного средства Illumina Local Run Manager, связанная с отсутствием процедуры авторизации, позволяющая нарушителю внедрять, воспроизводить, изменять и/или перехватывать конфиденциальные данные |
| BDU:2022-05498 | Уязвимость утилиты для передачи и синхронизации файлов Rsync, связанная с ошибками авторизации, позволяющая нарушителю записывать произвольные файлы |
| BDU:2022-05538 | Уязвимость программного обеспечения SAP Enterprise Extension Defense Forces Public Security, связанная с ошибками авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2022-05608 | Уязвимость компонента Build Handler плагина Jenkins Git Plugin, связанная с ошибками авторизации, позволяющая нарушителю обойти введенные ограничения безопасности и повысить свои привилегии |
| BDU:2022-05669 | Уязвимость компонента Application Business Partner Extension программной платформы SAP S/4HANA, позволяющая нарушителю повысить свои привилегии |
| BDU:2022-06104 | Уязвимость гипервизора Xen, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-06174 | Уязвимость браузера Firefox for iOS, связанная с ошибками авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2022-06329 | Уязвимость плагина Jenkins OpenShift Deployer Plugin, связанная с ошибками авторизации, позволяющая нарушителю обойти существующие ограничения безопасности и повысить свои привилегии |
| BDU:2022-06702 | Уязвимость функции изменения пароля доступа к веб-интерфейсу промышленных коммутаторов Siemens SCALANCE и RUGGEDCOM, позволяющая нарушителю повысить свои привилегии |
| BDU:2022-07249 | Уязвимость компонента Controller File System Handler плагина Jenkins OpenShift Deployer Plugin, позволяющая нарушителю обойти введенные ограничения безопасности и пвысить свои привилегии |
| BDU:2023-00047 | Уязвимость плагина Jenkins extreme-feedback Plugin, связанная с отсутствием проверки разрешений в подключаемом модуле, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации |
| BDU:2023-00049 | Уязвимость плагина Jenkins Tuleap Git Branch Source Plugin, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-00641 | Уязвимость декларативного инструмента непрерывной доставки GitOps для Kubernetes Argo CD, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-01079 | Уязвимость функции shell_exec() программного обеспечения для организации видеонаблюдения ZoneMinder, позволяющая нарушителю выполнить произвольный код |
| BDU:2023-01289 | Уязвимость программных интеграционных платформ SAP NetWeaver AS ABAP и SAP NetWeaver ABAP, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю перезаписывать произвольные файлы |
| BDU:2023-01385 | Уязвимость системы мониторинга критически важного оборудования StruxureWare Data Center Expert, связанная с недостатками процедуры авторизации, позволяющая нарушителю выполнять несанкционированные функции, изменять или удалять произвольный контент |
| BDU:2023-01480 | Уязвимость обработчика клиентских запросов системы безопасного управления доступом к IED Siemens RUGGEDCOM CROSSBOW, позволяющая нарушителю выполнить произвольные действия |
| BDU:2023-01481 | Уязвимость обработчика клиентских запросов системы безопасного управления доступом к IED Siemens RUGGEDCOM CROSSBOW, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-01482 | Уязвимость обработчика клиентских запросов системы безопасного управления доступом к IED RUGGEDCOM CROSSBOW, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-01773 | Уязвимость службы Kubernetes облачной платформы Red Hat OpenShift Data Science (RHODS), позволяющая нарушителю отправлять произвольные API-запросы |
| BDU:2023-02023 | Уязвимость загрузчика GRand Unified Bootloader (GRUB) операционной системы Cisco IOS XR маршрутизаторов Network Convergence System 540 Series и Cisco 9000 Series, позволяющая нарушителю выполнить произвольный код |
| BDU:2023-03013 | Уязвимость плагина Jenkins Cisco Spark Notifier Plugin, связанная с недостатками разграничения доступа, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-03078 | Уязвимость файла конфигурации authorize.conf платформы для операционного анализа Splunk Enterprise, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-03521 | Уязвимость оболочки EMUI операционной системы HarmonyOS, связанная с недостатками процедуры авторизации, позволяющая нарушителю запустить процедуру отображения рекламы или других случайных окон в произвольное время |
| BDU:2023-04017 | Уязвимость локального хранилища (localstorage) браузера Mozilla Firefox, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-04078 | Уязвимость функции createUser системы управления, диагностики и оптимизации работы сетевых устройств ProSafe Network Management NMS300, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-04089 | Уязвимость системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI, связанная с недостатками процедуры аутентификации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2023-04308 | Уязвимость службы bluetooth микропрограммного обеспечения чипсетов Unisoc, связанная с отсутствием проверки разрешений, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-04311 | Уязвимость службы bluetooth микропрограммного обеспечения чипсетов Unisoc, связанная с отсутствием проверки разрешений, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-04329 | Уязвимость веб-интерфейса микропрограммного обеспечения устройств централизованного управления сетью VMware SD-WAN Edge, позволяющая нарушителю обойти ограничения безопасности и получить доступ на чтение, изменение или удаление данных |
| BDU:2023-04559 | Уязвимость программных интеграционных платформ SAP NetWeaver AS ABAP и SAP NetWeaver ABAP, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации |
| BDU:2023-04595 | Уязвимость плагина EventON Lite системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-04702 | Уязвимость плагина Sitemap by click5 системы управления содержимым сайта WordPress, позволяющая нарушителю создать учетную запись с правами администратора и осуществить CSRF-атаку |
| BDU:2023-04921 | Уязвимость микропрограммного обеспечения веб-панелей для управления и мониторинга процессов в промышленных системах PHOENIX CONTACT WP 6xxx, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к... |
| BDU:2023-04931 | Уязвимость микропрограммного обеспечения веб-панелей для управления и мониторинга процессов в промышленных системах PHOENIX CONTACT WP 6xxx, связанная с недостатками процедуры авторизации, позволяющая нарушителю оказать воздействие на целостность и д... |
| BDU:2023-05010 | Уязвимость службы SAP BW BI Consumer Service (BICS) системы управления данными и аналитики SAP Business Warehouse и SAP BW/4HANA, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-05273 | Уязвимость платформы создания совместных веб-приложений XWiki Platform XWiki, связанная с ошибками авторизации, позволяющая нарушителю выполнить произвольный веб-скрипт с повышенными привилегиями |
| BDU:2023-05986 | Уязвимость программного обеспечения для управления медицинской организацией OpenEMR, связанная с ошибками авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06076 | Уязвимость платформы для разработки и доставки контейнерных приложений Docker Desktop, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить полные права администратора |
| BDU:2023-06214 | Уязвимость ядра оболочки EMUI операционной системы HarmonyOS, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность данных |
| BDU:2023-06416 | Уязвимость функции restore_settings плагина Comments Like Dislike системы управления содержимым сайта WordPress, позволяющая нарушителю оказать воздействие на целостность данных |
| BDU:2023-06457 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06476 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06477 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06479 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06480 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06481 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06482 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06483 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06485 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06486 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06487 | Уязвимость программного обеспечения резервного копирования и восстановления данных на компьютерах и серверах Acronis Agent, связанная с ошибками авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06492 | Уязвимость программного средства резервного копирования и восстановления данных Acronis Cyber Protect Home Office, связанная с ошибками авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06709 | Уязвимость плагина Jenkins Fortify Plugin, связанная с ошибками авторизации, позволяющая нарушителю получить доступ к сессии другого пользователя |
| BDU:2023-06945 | Уязвимость компонента Withholding Tax Items программной платформы SAP S/4HANA, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-07139 | Уязвимость программного обеспечения WebTutor, связанная с отсутствием авторизации, позволяющая нарушителю выполнить произвольный код |
| BDU:2023-07391 | Уязвимость библиотеки SAP CommonCryptoLib, связанная с недостатками процедуры авторизации, позволяющая нарушителю читать, изменять или удалять данные с ограниченным доступом |
| BDU:2023-07398 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab Enterprise Edition, связнная с недостатками процедуры авторизации, позволяющая нарушителю запускать задания конвейера от имени произвольного пользователя |
| BDU:2023-07528 | Уязвимость функций pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta и pmdm_wp_ajax_delete_meta плагина для системы управления содержимым сайта WordPress Post Meta Data Manager, позволяющая нарушителю удалить произвольные метаданные пользователей |
| BDU:2023-07529 | Уязвимость функций pmdm_wp_change_user_meta и pmdm_wp_change_post_meta плагина Post Meta Data Manager для системы управления содержимым сайта WordPress, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-08031 | Уязвимость реализации прикладного программного интерфейса системы аудита безопасности эксплуатации и обслуживания JumpServer, позволяющая нарушителю обойти процесс аутентификации |
| BDU:2023-08356 | Уязвимость функции admin_init() плагина Swift Performance Lite системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-08538 | Уязвимость платформы анализа данных Hazelcast, связанная с недостатками процедуры авторизации, позволяющая нарушителю выполнять произвольные действия |
| BDU:2023-08588 | Уязвимость пакета Skupper программного средства Red Hat Service Interconnect, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-08669 | Уязвимость технологии WebSocket Java-фреймворка Quarkus, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и повысить свои привилегии |
| BDU:2023-08975 | Уязвимость плагина User Post Gallery системы управления содержимым сайта WordPress, позволяющая нарушителю выполнить произвольный код |
| BDU:2024-00143 | Уязвимость модуля SocketService программного обеспечения для управления источниками бесперебойного питания Voltronic Power ViewPower Pro, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2024-00423 | Уязвимость функции public_website() плагина Hostinger системы управления содержимым сайта WordPress, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-00504 | Уязвимость операционной системы NEXO-OS инструментов для монтажных работ на производственных линиях Bosch Nexo cordless nutrunner и Bosch Nexo special cordless nutrunner, позволяющая нарушителю загружать произвольные файлы |
| BDU:2024-00506 | Уязвимость операционной системы NEXO-OS инструментов для монтажных работ на производственных линиях Bosch Nexo cordless nutrunner и Bosch Nexo special cordless nutrunner, позволяющая нарушителю читать произвольные файлы |
| BDU:2024-00631 | Уязвимость плагина POST SMTP Mailer системы управления содержимым сайта WordPress, позволяющая нарушителю сбросить ключ API и получить несанкционированный доступ к защищаемой информации |
| BDU:2024-00745 | Уязвимость функции save_management_settings() плагина InstaWP Connect системы управления содержимым сайта WordPress, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных |
| BDU:2024-00753 | Уязвимость программного обеспечения создания, мониторинга и оркестрации сценариев обработки данных Airflow, связанная с отсутствием авторизации, позволяющая нарушителю получить доступ к исходному коду DAG |
| BDU:2024-01136 | Уязвимость плагина ActivityPub системы управления содержимым сайта WordPress, повзволяющая нарушителю выполнять несанкционированные функции, изменять или удалять произвольный контент |
| BDU:2024-01180 | Уязвимость интерфейса приложения Poly Lens телефонов и акустических систем для конференц-связи Poly Trio, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-01268 | Уязвимость платформы создания совместных веб-приложений XWiki Platform XWiki , связанная с ошибками авторизации, позволяющая нарушителю редактировать произвольный документ |
| BDU:2024-01993 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с отсутствием процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к проекту |
| BDU:2024-02115 | Уязвимость плагина Podlove Web Player системы управления содержимым сайта WordPress, связанная с недостатками процедуры авторизации, позволяющая нарушителю оказать воздействие на целостность и конфиденциальность защищаемой информации |
| BDU:2024-02556 | Уязвимость фреймворка для масштабирования приложений AI и Python Ray, связанная с недостатками процедуры авторизации, позволяющая нарушителю читать произвольные файлы в каталоге /static/ |
| BDU:2024-02669 | Уязвимость реализации прикладного программного интерфейса Client фреймворка для масштабирования приложений AI и Python Ray, позволяющая нарушителю выполнить произвольные команды |
| BDU:2024-02952 | Уязвимость облачного программного обеспечения защиты данных Acronis Cyber Protect Cloud, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-03017 | Уязвимость компонента Enter Package Data программного обеспечения для сбора финансовых данных для бизнеса SAP Group Reporting Data Collection, позволяющая нарушителю повысить свои привилегии и оказать воздействие на целостность данных |
| BDU:2024-03356 | Уязвимость функции tutor_delete_announcement() плагина Tutor LMS системы управления содержимым сайта WordPress, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-03358 | Уязвимость функции hide_notices() плагина Tutor LMS системы управления содержимым сайта WordPress, позволяющая нарушителю получить доступ на чтение и изменение данных |
| BDU:2024-03374 | Уязвимость функции wpa_check_authentication() плагина Analytify системы управления содержимым сайта WordPress, позволяющая нарушителю изменить идентификатор отслеживания Google Analytics сайта |
| BDU:2024-03375 | Уязвимость функции update_form() плагина Admin Bar Editor системы управления содержимым сайта WordPress, позволяющая нарушителю включать или отключать панель администратора на внешнем интерфейсе сайта |
| BDU:2024-03569 | Уязвимость системных представлений pg_stats_ext, pg_stats_ext_exprs СУБД PostgreSQL, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-04265 | Уязвимость компонента My Overtime Request платформы проектирования бизнес-приложений SAP Fiori, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации |
| BDU:2024-04306 | Уязвимость платформы управления данными SAP Master Data Governance, связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии и раскрыть защищаемую информацию |
| BDU:2024-04307 | Уязвимость средства для управления банковскими счетами SAP Bank Account Management (BAM), связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-04427 | Уязвимость функции postx_presets_callback() плагина PostX системы управления содержимым сайта WordPres, позволяющая нарушителю повысить свои привилегии и получить доступ на чтение, изменение или удаление данных |
| BDU:2024-04596 | Уязвимость системы безопасного управления доступом к IED Siemens RUGGEDCOM CROSSBOW, позволяющая нарушителю выполнить произвольный код |
| BDU:2024-04644 | Уязвимость реализации модуля единого входа в приложения (SAML) для служб удаленного доступа VPN микропрограммного обеспечения межсетевых экранов Cisco Adaptive Security Appliance (ASA) и Cisco Firepower Threat Defense (FTD), позволяющая нарушителю ус... |
| BDU:2024-04740 | Уязвимость компонента System webapi приложения для организации видеонаблюдения Surveillance Station, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-05079 | Уязвимость компонента Manage Incoming Payment Files программной платформы SAP S/4HANA, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2024-05090 | Уязвимость реализации процесса преобразования и передачи данных Transformation and Data Transfer Process (DTP) системы управления данными и аналитики SAP BW/4HANA, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-05100 | Уязвимость системы управления жизненным циклом студентов в высших учебных заведениях SAP Student Life Cycle Management (SLcM), связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-05213 | Уязвимость программного интерфейса Text Services Framework операционных систем Windows, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-05255 | Уязвимость механизма аутентификации Single sign-on (SSO) веб-интерфейса GitLab Duo Chat программной платформы на базе git для совместной работы над кодом GitLab, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-05346 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-05350 | Уязвимость компонента Auto-attach Option Handler программного средства управления проектами и задачами JetBrains YouTrack, позволяющая нарушителю включить опцию автоматического присоединения к рабочим процессам |
| BDU:2024-06241 | Уязвимость функционала единого входа (SSO) платформы бизнес-аналитики SAP BusinessObjects Business Intelligence, позволяющая нарушителю получить полный доступ к устройству |
| BDU:2024-06311 | Уязвимость компонента org.xwiki.platform:xwiki-platform-oldcore платформы создания совместных веб-приложений XWiki Platform XWiki, позволяющая нарушителю выполнить произвольный код |
| BDU:2024-06700 | Уязвимость браузера Firefox, Firefox ESR, связанная с отсутствием диалогового окна подтверждения при открытии связанных с Usenet схем "news:" и "snews:", позволяющая нарушителю загрузить произвольное приложение и выполнить произвольный код |
| BDU:2024-07027 | Уязвимость командной оболочки Bash операционной системы Cisco NX-OS коммутаторов Cisco Nexus 3000 и Nexus 9000, позволяющая нарушителю выполнить произвольные команды |
| BDU:2024-07036 | Уязвимость плагинов InPost для WooCommerce и плагин InPost PL для WordPress, позволяющая нарушителю выполнить произвольный код |
| BDU:2024-07043 | Уязвимость программного средства управления сетевыми сервисами SAP Shared Service Framework, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-07623 | Уязвимость компонента Blink веб-браузера Google Chrome, позволяющая нарушителю получить доступ к конфиденциальным данным |
| BDU:2024-08045 | Уязвимость программных интеграционных платформ SAP NetWeaver AS ABAP, SAP NetWeaver AS for Java, сервера содержимого SAP Content Server и веб-диспетчера SAP Web Dispatcher, связанная с недостатками процедуры авторизации, позволяющая нарушителю оказат... |
| BDU:2024-08046 | Уязвимость системы управления жизненным циклом студентов в высших учебных заведениях SAP Student Life Cycle Management (SLcM)t, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-08048 | Уязвимость программного средства управления сетевыми сервисами SAP Shared Service Framework, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-08159 | Уязвимость компонента Web Server программного средства для создания отчетов Oracle BI Publisher, позволяющая нарушителю получить полный контроль над приложением |
| BDU:2024-08256 | Уязвимость компонента Item Catalog программного средства управления данными Oracle Product Hub системы автоматизации деятельности предприятия Oracle E-Business Suite, позволяющая нарушителю получить доступ на изменение, добавление и удаление данных |
| BDU:2024-08297 | Уязвимость компонента Quality Manager Specification приложения управления процессами разработки Oracle Process Manufacturing (OPM) Product Development системы автоматизации деятельности предприятия Oracle E-Business Suite, позволяющая нарушителю полу... |
| BDU:2024-08492 | Уязвимость компонента SplunkDeploymentServerConfig платформы для операционного анализа Splunk Enterprise, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2024-08542 | Уязвимость интерфейса программного средства управления проектами и задачами JetBrains YouTrack, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-08549 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-08571 | Уязвимость компонента OSB Core Functionality интеграционной платформы для управления, маршрутизации и обработки сообщений между приложениями и сервисами Oracle Service Bus (OSB), позволяющая нарушителю получить несанкционированный доступ к защищаемой... |
| BDU:2024-08829 | Уязвимость платформы управления данными Microsoft Dataverse, связанная с отсутствием процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-08899 | Уязвимость конфигурационных настроек директории /api/configs пользовательского интерфейса Nginx UI сервера nginx, позволяющая нарушителю читать произвольные файлы |
| BDU:2024-08941 | Уязвимость реализации протокола Real-Time Streaming Protocol (RTSP) микропрограммного обеспечения сетевой IP-камеры D3D Security IP Camera D8801, позволяющая нарушителю получить доступ к видеопотоку |
| BDU:2024-09069 | Уязвимость программных интеграционных платформ SAP NetWeaver Application Server ABAP и ABAP Platform, связнная с недостатками процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2024-09079 | Уязвимость программного обеспечения управления аккаунтами JetBrains Hub, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-09283 | Уязвимость микропрограммного обеспечения маршрутизаторов D-Link DIR-823G, связанная с недостаточной защитой служебных данных, позволяющая получить несанкционированный доступ к защищаемой информации |
| BDU:2024-09318 | Уязвимость программного обеспечения для связи с контролируемыми устройствами Schneider Electric EcoStruxure IT Gateway, связанная с отсутствием процедуры авторизации, позволяющая нарушителю получить полный доступ к уязвимому программному обеспечению |
| BDU:2024-09425 | Уязвимость виртуальной обучающей среды Moodle, связанная с отсутствием авторизации, позволяющая нарушителю удалить данные |
| BDU:2024-09430 | Уязвимость корпоративной версии платформы GitHub Enterprise Server, связанная с недостатками процедуры авторизации, позволяющая нарушителю получать доступ к конфиденциальным данным |
| BDU:2024-10174 | Уязвимость компонента CMDaemon программного средства для управления рабочей нагрузкой и мониторинга инфраструктуры NVIDIA Base Command Manager, позволяющая нарушителю выполнить произвольный код |
| BDU:2024-10212 | Уязвимость реализации прикладного программного интерфейса платформы управления сетевыми ресурсами Cisco Nexus Dashboard Fabric Controller (NDFC), связанная с отсутствием авторизации, позволяющая нарушителю оказать влияние нацелостность защищаемой инф... |
| BDU:2024-10214 | Уязвимость реализации прикладного программного интерфейса платформы аналитики и автоматизации работы с многооблачными сетями дата-центров Cisco Nexus Dashboard, связанная с отсутствием авторизации, позволяющая нарушителю оказать влияние на целостност... |
| BDU:2024-10215 | Уязвимость реализации прикладного программного интерфейса платформы управления сетевыми ресурсами Cisco Nexus Dashboard Fabric Controller (NDFC), связанная с отсутствием авторизации, позволяющая нарушителю оказать влияние на целостность и доступность... |
| BDU:2024-10261 | Уязвимость виртуальной обучающей среды Moodle, связанная с отсутствием процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к элементам системы |
| BDU:2024-10271 | Уязвимость компонента Socket Intercept Command File Interface операционной системы Juniper Networks Junos OS Evolved, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-10422 | Уязвимость гибридного облачного решения для управления тонкими клиентами Dell Wyse Management Suite, связанная с отсутствием процедуры авторизации, позволяющая нарушителю вызвать отказ в обслуживании и удалить произвольные файлы |
| BDU:2024-10538 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab EE/ CE , связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-10542 | Уязвимость программной интеграционной платформы SAP NetWeaver AS Java, связанная с отсутствием процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации |
| BDU:2024-10549 | Уязвимость модулей для защиты от спама Spam protection, AntiSpam, FireWall плагина CleanTalk для системы управления содержимым сайта WordPress, связанная с недостатками процедуры авторизации, позволяющая нарушителю выполнить произвольный код |
| BDU:2024-10856 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с отсутствием процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-10867 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с отсутствием процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-10998 | Уязвимость HTTP-метода GET программного средства управления системами в режиме One-to-one Dell OpenManage Server Administrator (OMSA), позволяющая нарушителю повысить свои привилегии |
| BDU:2024-11009 | Уязвимость программного обеспечения управления ресурсами человеческого капитала в организации SAP Human Capital Management (HCM), связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-11217 | Уязвимость службы управления Veeam Backup Enterprise Manager средства защиты облачных, виртуальных и физических систем Veeam Backup Replication, позволяющая нарушителю повысить свои привилегии и вызвать отказ в обслуживании |
| BDU:2024-11244 | Уязвимость гиперконвергентной инфраструктуры программно-аппаратной платформы Microsoft Azure Stack (HCI), связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-11260 | Уязвимость функции wpforms_is_admin_page() плагина WPForms системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ на чтение и изменение данных |
| BDU:2024-11276 | Уязвимость средства резервного копирования данных Veeam Agent for Linux, связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии до уровня root |
| BDU:2024-11299 | Уязвимость программного обеспечения для управления системой контроля доступа Geovision GV-ASManager, связанная с отсутствием процедуры авторизации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2024-11300 | Уязвимость плагина StylemixThemes eRoom - Zoom Meetings Webinar системы управления содержимым сайта WordPress, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-11316 | Уязвимость функции permission_callback плагина Hunk Companion системы управления содержимым сайта WordPress, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS) |
| BDU:2024-11402 | Уязвимость программного обеспечения разработки и выполнения приложений на языке ABAP SAP NetWeaver Application Server ABAP, связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-11496 | Уязвимость приложения для обмена мгновенными сообщениями Mattermost, связанная с отсутствием процедуры авторизации, позволяющая нарушителю удалить произвольное сообщение |
| BDU:2024-11624 | Уязвимость системы непрерывной интеграции и доставки приложений (CI/CD) JetBrains TeamCity, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2024-11637 | Уязвимость компонента Advanced Payment Management программного средства управления финансами SAP S/4HANA Finance, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-11638 | Уязвимость программы для создания и управления обучающими материалами SAP Enable Now, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации |
| BDU:2025-00253 | Уязвимость модуля Open Social CMS-системы Drupal, связанная с недостатками процедуры авторизации, позволяющая нарушителю обойти ограничения безопасности и реализовать атаку принудительного просмотра (Forceful Browsing) |
| BDU:2025-00259 | Уязвимость модуля Download All Files CMS-системы Drupal, связанная с отсутствием авторизации, позволяющая нарушителю обойти ограничения безопасности и реализовать атаку принудительного просмотра (Forceful Browsing) |
| BDU:2025-00465 | Уязвимость программного обеспечения разработки и выполнения приложений на языке ABAP SAP NetWeaver Application Server ABAP, связанная с отсутствием авторизации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-00701 | Уязвимость микропрограммного обеспечения маршрутизаторов Four-Faith F3x24, связанная с отсутствием авторизации, позволяющая нарушителю выполнить произвольный код |
| BDU:2025-00865 | Уязвимость модуля Entity Delete Log CMS-системы Drupal, связанная с неправильной авторизацией, позволяющая нарушителю обойти ограничения безопасности и реализовать атаку принудительного просмотра (Forceful Browsing) |
| BDU:2025-01033 | Уязвимость сервера веб-приложений SAP NetWeaver Java Application Server, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-01101 | Уязвимость файла /admin/tag/save системы управления контентом Jfinal CMS, позволяющая нарушителю осуществить CSRF-атаку |
| BDU:2025-01196 | Уязвимость системы непрерывной интеграции и доставки приложений (CI/CD) JetBrains TeamCity, позволяющая нарушителю получить доступ к конфиденциальной информации |
| BDU:2025-01262 | Уязвимость компонента WebKit браузера Safari операционных систем macOS, iOS, iPadOS, tvOS, visionOS, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-01285 | Уязвимость компонента Design Tools SEC системы управления ресурсами предприятия JD Edwards EnterpriseOne Tools, позволяющая нарушителю получить доступ на чтение, изменение, добавление или удаление данных |
| BDU:2025-01306 | Уязвимость средства для создания и управления документами SAP Document Builder, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-01370 | Уязвимость компонента Password Autofill операционных систем visionOS, iOS, iPadOS, MacOS и watchOS, позволяющая нарушителю читать и записывать произвольные файлы |
| BDU:2025-01382 | Уязвимость операционных систем macOS, связанная с отсутствием авторизации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-01644 | Уязвимость компонента OSB Core Functionality интеграционной платформы для управления, маршрутизации и обработки сообщений между приложениями и сервисами Oracle Service Bus (OSB), позволяющая нарушителю получить несанкционированный доступ к защищаемой... |
| BDU:2025-02154 | Уязвимость сервера бизнес-аналитики Hitachi Vantara Pentaho Business Analytics Server, связанная с отсутствием авторизации, позволяющая нарушителю раскрыть защищаемую информацию или вызвать отказ в обслуживании |
| BDU:2025-02195 | Уязвимость компонента виртуального устройства Delegated License Service (DLS) системы лицензирования NVIDIA, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и вызвать отказ в обслуживании |
| BDU:2025-03141 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с отсутствием процедуры авторизации, позволяющая нарушителю изменять статус задач в общедоступных проектах |
| BDU:2025-03174 | Уязвимость компонента Service Layer системы управления ресурсами предприятия SAP Business One, позволяющая нарушителю повысить свои привилегии и получить доступ на чтение, изменение и/или добавление данных |
| BDU:2025-03176 | Уязвимость компонента Process Chains системы управления данными и аналитики SAP Business Warehouse, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2025-03228 | Уязвимость плагина Tutor LMS системы управления содержимым сайта WordPress, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-03626 | Уязвимость приложения для мониторинга и управления подтверждения поставок SAP Just In Time, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2025-03629 | Уязвимость компонента eDocument Cockpit программного обеспечения для обработки электронных счетов-фактур SAP Electronic Invoicing for Brazil, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-03792 | Уязвимость сервера автоматизации Jenkins, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации |
| BDU:2025-03793 | Уязвимость сервера автоматизации Jenkins, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации |
| BDU:2025-03802 | Уязвимость сервера системы управления базами данных MongoDB, связанная с отсутствием процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации |
| BDU:2025-03903 | Уязвимость пакета программ сетевого взаимодействия Samba, связанная с ошибками авторизации, позволяющая нарушителю получить доступ к конфиденциальным данным |
| BDU:2025-04025 | Уязвимость компонента PDFClass Handler платформы создания совместных веб-приложений XWiki Platform XWiki, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-04298 | Уязвимость программной интеграционной платформы SAP NetWeaver, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации |
| BDU:2025-04574 | Уязвимость компонента Name Handler инструмента настройки сервисов Consul и Consul Enterprise, позволяющая нарушителю получить доступ к потенциально конфиденциальной информации |
| BDU:2025-04744 | Уязвимость инструмента управления базами данных pgAdmin 4, связанная с отсутствием авторизации, позволяющая нарушителю обойти проверку авторизации и выполнить произвольный код |
| BDU:2025-04837 | Уязвимость платформы управления программными средами SAP Solution Manage, связанная с недостатками процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2025-04838 | Уязвимость платформы электронной коммерции SAP Commerce Cloud, связанная с недостатками процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2025-04839 | Уязвимость программной интеграционной платформы SAP NetWeaver Application Server ABAP, связанная с недостатками процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2025-04841 | Уязвимость компонента RFC Enabled Function Module программных интеграционных платформ SAP NetWeaver и ABAP Platform, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-04845 | Уязвимость бизнес-приложения для управления знаниями SAP KMC WPC, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05162 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab Enterprise Edition, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05353 | Уязвимость компонента org.xwiki.platform:xwiki-platform-repository-rest-server платформы создания совместных веб-приложений XWiki Platform, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05355 | Уязвимость компонента org.xwiki.platform:xwiki-platform-security-authentication-ui платформы создания совместных веб-приложений XWiki Platform, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05356 | Уязвимость компонента org.xwiki.platform:xwiki-platform-component-wiki платформы создания совместных веб-приложений XWiki Platform, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05538 | Уязвимость операционных систем MacOS, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05791 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab EE/ CE, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2025-05980 | Уязвимость функции ayssavegoogle_credentials() плагина Quiz Maker системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и проводить межсайтовые сценарные атаки |
| BDU:2025-06112 | Уязвимость компонента Grade Report Handler виртуальной обучающей среды Moodle, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-06166 | Уязвимость оркестратора приложений Nomad, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-06167 | Уязвимость оркестратора приложений Nomad, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-06173 | Уязвимость оркестратора приложений Nomad, связанная с некорректной обработкой заголовка сетевого пакета, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-06372 | Уязвимость плагина Zoho Flow системы управления содержимым сайта WordPress, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-06654 | Уязвимость программной интеграционной платформы SAP NetWeaver Application Server ABAP, связанная с отсутствием механизма проверки подлинности при обработке входящих RFC-запросов, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-06756 | Уязвимость компонента Enterprise Event Enablement программной платформы SAP S/4HANA, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код |
| BDU:2025-06758 | Уязвимость плагина SAP Plug-In Basis системы управления данными и аналитики SAP Business Warehouse, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-06759 | Уязвимость плагина AC системы управления рисками, соблюдения нормативных требований и корпоративного управления SAP GRC (Governance, Risk, and Compliance), позволяющая нарушителю получить несанкционированный доступ на чтение и изменение данных |
| BDU:2025-06828 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab Enterprise Edition (EE), связанная с недостатками процедуры авторизации, позволяющая нарушителю получить доступ на чтение и изменение данных |
| BDU:2025-07573 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-07635 | Уязвимость системы непрерывной интеграции и доставки приложений (CI/CD) JetBrains TeamCity, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2025-07920 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостатками процедуры авторизации, позволяющая нарушителю обойти ограничения безопасности и получить доступ на чтение и изменение данных |
| BDU:2025-07921 | Уязвимость интерфейса GraphQL API программной платформы на базе git для совместной работы над кодом GitLab, позволяющая нарушителю обойти ограничения безопасности и повысить свои привилегии |
| BDU:2025-08109 | Уязвимость компонента CRM User Management Framework пакета приложений Oracle Common Applications системы автоматизации деятельности предприятия Oracle E-Business Suite, позволяющая нарушителю получить несанкционированный доступ к защищаемой информаци... |
| BDU:2025-08330 | Уязвимость службы StateRepository операционной системы Windows, позволяющая нарушителю получить доступ на чтение и изменение данных |
| BDU:2025-08747 | Уязвимость веб-интерфейса программного обеспечения для управления политиками безопасности Juniper Networks Security Director, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-08750 | Уязвимость компонента Virtual Routing and Forwarding (VRF) операционных систем Juniper Networks Junos OS Evolved, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-08799 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с отсутствием процедуры авторизации, позволяющая нарушителю проводить спуфинг-атаки |
| BDU:2025-09118 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09371 | Уязвимость функции get_details() плагина POST SMTP системы управления содержимым сайта WordPress, позволяющая нарушителю повысить свои привилегии и раскрыть защищаемую информацию |
| BDU:2025-09686 | Уязвимость корпоративной версии платформы GitHub Enterprise Server, связанная с отсутствием процедуры авторизации, позволяющая нарушителю видеть имена частных репозиториев |
| BDU:2025-09757 | Уязвимость плагина Confluence приложения для обмена мгновенными сообщениями Mattermost, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09758 | Уязвимость плагина Confluence приложения для обмена мгновенными сообщениями Mattermost, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и повысить свои привилегии |
| BDU:2025-09759 | Уязвимость плагина Confluence приложения для обмена мгновенными сообщениями Mattermost, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-09760 | Уязвимость плагина Confluence приложения для обмена мгновенными сообщениями Mattermost, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-09766 | Уязвимость плагина Confluence приложения для обмена мгновенными сообщениями Mattermost, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-10074 | Уязвимость службы Remote Desktop Services (RDS) операционных систем Windows, позволяющая нарушителю получить несанкционированный доступ на изменение защищаемой информации |
| BDU:2025-10224 | Уязвимость платформы виртуализации VMware Cloud Foundation, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-10330 | Уязвимость операционных систем Cisco IOS коммутаторов Cisco Industrial Ethernet 2000, 4000, 4010 и 5000, связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-10423 | Уязвимость компонента Manage Processing Rules (For Bank Statement) программной платформы SAP S/4HANA, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2025-10425 | Уязвимость компонента Bank Account Application программной платформы SAP S/4HANA, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2025-10428 | Уязвимость компонента Manage Central Purchase Contract программной платформы SAP S/4HANA, позволяющая нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации |
| BDU:2025-10435 | Уязвимость компонента EPC2 микропрограммного обеспечения промышленного цифрового газоанализатора MEAC300-FNADE4, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации |
| BDU:2025-10461 | Уязвимость компонента NFS Export операционной системы PowerScale OneFS, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-10640 | Уязвимость программных интеграционных платформ SAP NetWeaver и ABAP Platform, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2025-10642 | Уязвимость программного обеспечения разработки и выполнения приложений на языке ABAP SAP NetWeaver Application Server ABAP, связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-10651 | Уязвимость системы управления данными и аналитики SAP Business Warehouse, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2025-10652 | Уязвимость программного обеспечения разработки и выполнения приложений на языке ABAP SAP NetWeaver Application Server ABAP, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2025-10654 | Уязвимость программной интеграционной платформы SAP NetWeaver, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2025-10935 | Уязвимость микропрограммного обеспечения сетевого видеорегистратора Digiever DS-2105 Pro, связанная с отсутствием авторизации, позволяющая нарушителю выполнить произвольные команды |
| BDU:2025-11006 | Уязвимость программного обеспечения администрирования сети Cisco Secure Firewall Management Center (ранее Cisco Firepower Management Center), связанная с недостатками процедуры авторизации, позволяющая нарушителю раскрыть конфиденциальную информацию |
| BDU:2025-11007 | Уязвимость программного обеспечения администрирования сети Cisco Secure Firewall Management Center (ранее Cisco Firepower Management Center), связанная с недостатками процедуры авторизации, позволяющая нарушителю получить доступ на чтение данных |
| BDU:2025-11290 | Уязвимость изолированной программной среды Sandbox операционных систем iOS, iPadOS, tvOS, watchOS, macOS, позволяющая нарушителю обойти защитный механизм песочницы |
| BDU:2025-11515 | Уязвимость компонента SharedFileList операционных систем MacOS, позволяющая нарушителю обойти существующие ограничения безопасности и повысить свои привилегии |
| BDU:2025-11518 | Уязвимость компонента Shortcuts операционных систем MacOS, iPadOS и iOS, позволяющая нарушителю обойти существующие ограничения безопасности и повысить свои привилегии |
| BDU:2025-11603 | Уязвимость операционной системы Android, связанная с отсутствием авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-11606 | Уязвимость функции isSystem файла WifiPermissionsUtil.java операционной системы Android, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2025-11645 | Уязвимость компонента Framework операционных систем Android, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код |
| BDU:2025-11688 | Уязвимость компонента Framework операционных систем Android, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-11751 | Уязвимость веб-сервера VPN микропрограммного обеспечения межсетевых экранов Cisco Adaptive Security Appliance (ASA) и Cisco Firepower Threat Defense (FTD), позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой инфо... |
| BDU:2025-12463 | Уязвимость платформы для работы с кодом GitFlic, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-12464 | Уязвимость платформы для работы с кодом GitFlic, связанная с отсутствием авторизации, позволяющая нарушителю выполнять произвольные http-запросы от имени сервера |
| BDU:2025-12672 | Уязвимость сервисов управления интегрированными средами разработки IDE Services, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить привилегии |
| BDU:2025-12842 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с отсутствием процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-12945 | Уязвимость системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI, связанная с ошибками разграничения доступа, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-12946 | Уязвимость системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI, связанная с ошибками разграничения доступа, позволяющая нарушителю получить несанкционированный доступ на удаление защищаемой информации |
| BDU:2025-12947 | Уязвимость функции внешних ссылок системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-12950 | Уязвимость программного интерфейса платформы создания совместных веб-приложений XWiki Platform XWiki, связанная с недостаточной проверкой подлинности выполняемых запросов, позволяющая нарушителю осуществить CSRF-атаку |
| BDU:2025-12955 | Уязвимость функционального модуля RFC-интерфейса программных интеграционных платформ SAP NetWeaver Application Server ABAP и ABAP Platform, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2025-12956 | Уязвимость системы управления данными и аналитики SAP Business Warehouse, связанная с недостатками процедуры авторизации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-12957 | Уязвимость системы управления данными и аналитики SAP Business Warehouse, связанная с недостатками процедуры авторизации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-12959 | Уязвимость программных интеграционных платформ SAP NetWeaver Application Server ABAP и ABAP Platform, связанная с недостатками процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2025-12961 | Уязвимость программного решения для оптимизации операций в промышленности SAP for Oil Gas, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить доступ на удаление пользовательских данных |
| BDU:2025-13316 | Уязвимость компонента Detail View программного обеспечения для аналитики и анализа данных Hitachi Ops Center Analyzer, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2025-13332 | Уязвимость приложения для обмена мгновенными сообщениями Mattermost, связанная с недостатками процедуры авторизации, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2025-13336 | Уязвимость реализации протокола OAuth приложения для обмена мгновенными сообщениями Mattermost, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2025-13340 | Уязвимость приложения для обмена мгновенными сообщениями Mattermost, связанная с отсутствием авторизации, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2025-13455 | Уязвимость облачного корпоративного решения для планирования и управления программными и ИТ-проектами Jira Align (ранее AgileCraft), связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаем... |
| BDU:2025-13579 | Уязвимость прикладного программного интерфейса программной платформы на базе git для совместной работы над кодом GitLab EE, связанная с ошибками разграничения доступа, позволяющая нарушителю получить несанкционированный доступ к агентам из другого пр... |
| BDU:2025-13804 | Уязвимость компонента UEFI микропрограммного обеспечения встраиваемых платформ для искусственного интеллекта NVIDIA Jetson Orin Series и NVIDIA Jetson Xavier Series, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2025-14034 | Уязвимость компонента Compiler виртуальной машины Oracle GraalVM for JDK, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-14083 | Уязвимость функции CREATE STATISTICS системы управления базами данных PostgreSQL, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2025-14153 | Уязвимость платформ для составления отчётов Nuance PowerScribe One и Nuance PowerScribe 360, связанная с отсутствием авторизации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-14460 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-14472 | Уязвимость инструмента для мониторинга ИТ-инфраструктуры Nagios XI, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-14492 | Уязвимость веб-терминала SSH инструмента для мониторинга ИТ-инфраструктуры Nagios XI, позволяющая нарушителю выполнить произвольный код и раскрыть защищаемую информацию |
| BDU:2025-14683 | Уязвимость модуля XWiki Remote Macros платформы создания совместных веб-приложений XWiki Platform XWiki, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-14704 | Уязвимость конфигурации Allow Insecure Logins инструмента для мониторинга ИТ-инфраструктуры Nagios XI, позволяющая нарушителю повысить свои привилегии и получить полный контроль над приложением |
| BDU:2025-14726 | Уязвимость операционной системы OxygenOS устройств OnePlus 8T и 10 Pro 5G, связанная с непринятием мер по защите структуры запроса SQL, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации |
| BDU:2025-14895 | Уязвимость программного обеспечения управления аккаунтами JetBrains Hub, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-14915 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с недостатками процедуры авторизации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-14916 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить доступ на чтение и изменение данных |
| BDU:2025-14928 | Уязвимость прикладного программного интерфейса программной платформы на базе git для совместной работы над кодом GitLab, связанная с отсутствием процедуры авторизации, позволяющая нарушителю выполнить произвольный код |
| BDU:2025-15404 | Уязвимость функции __construct плагина POST SMTP системы управления содержимым сайта WordPress, позволяющая нарушителю повысить свои привилегии и раскрыть защищаемую информацию |
| BDU:2025-15429 | Уязвимость пакета офисных программ Apache OpenOffice, связанная с отсутствием авторизации, позволяющая нарушителю обойти существующие ограничения безопаности путем загрузки специально созданных файлов |
| BDU:2025-15431 | Уязвимость пакета офисных программ Apache OpenOffice, связанная с отсутствием авторизации, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2025-15432 | Уязвимость пакета офисных программ Apache OpenOffice, связанная с отсутствием авторизации, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2025-15433 | Уязвимость пакета офисных программ Apache OpenOffice, связанная с отсутствием авторизации, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2025-15434 | Уязвимость пакета офисных программ Apache OpenOffice, связанная с отсутствием авторизации, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2025-15438 | Уязвимость пакета офисных программ Apache OpenOffice, связанная с отсутствием авторизации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-15449 | Уязвимость межсетевого экрана PT NGFW, связанная с отсутствием авторизации, позволяющая нарушителю получить доступ к защищаемой информации |
| BDU:2025-15899 | язвимость системы поиска Enterprise Search программной интеграционной платформы SAP ABAP Platform, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-15904 | Уязвимость компонента AuthN системы распределённого хранения данных для приложений на основе искусственного интеллекта NVIDIA AIStore, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-15910 | Уязвимость микропрограммного обеспечения сетевых устройств Zyxel ATP, USG FLEX и USG FLEX 50(W)/USG20(W)-VPN, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации |
| BDU:2025-16006 | Уязвимость веб-интерфейса средства администрирования Juniper Networks Junos Space Security Director, позволяющая нарушителю получить несанкционированный доступ на чтение и изменение защищаемой информации |
| BDU:2025-16082 | Уязвимость инструмента Service Data Control Center (SDCCN) программных интеграционных платформ SAP NetWeaver и ABAP Platform, позволяющая нарушителю обойти ограничения безопасности и получить несанкционированный доступ к защищаемой информации |
| BDU:2025-16145 | Уязвимость консоли управления микропрограммного обеспечения межсетевых экранов SonicWall SMA1000, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-16207 | Уязвимость программных обеспечений 1С: ERP Управление предприятием, 1С:Комплексная автоматизация, 1С:Управление торговлей, связанная с отсутствием авторизации, позволяющая нарушителю выполнять произвольные запросы |
| BDU:2025-16260 | Уязвимость плагина SAP Plug-In Basis системы управления данными и аналитики SAP Business Warehouse, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-16306 | Уязвимость программной интеграционной платформы SAP NetWeaver ABAP, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-16322 | Уязвимость гибридного облачного решения для управления тонкими клиентами Dell Wyse Management Suite, связанная с отсутствием авторизации, позволяющая нарушителю обойти существующие механизмы безопасности |
| BDU:2025-16351 | Уязвимость клиента реализации протокола Kermit пакета программного обеспечения для последовательной и сетевой связи C-Kermit, позволяющая нарушителю выполнить произвольный код |
| BDU:2025-16385 | Уязвимость плагина Malcure Malware Scanner системы управления содержимым сайта WordPress, позволяющая нарушителю выполнить произвольный код |
| BDU:2026-00020 | Уязвимость компонента My Timesheet Fiori 2.0 программного обеспечения для управления персоналом SAP HCM, позволяющая нарушителю повысить привилегии |
| BDU:2026-00021 | Уязвимость программного обеспечения разработки и выполнения приложений на языке ABAP SAP NetWeaver Application Server ABAP, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить доступ на чтение параметров профиля |
| BDU:2026-00023 | Уязвимость программной интеграционной платформы SAP NetWeaver, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить доступ на чтение системных данных |
| BDU:2026-00025 | Уязвимость компонента My Timesheet Fiori 2.0 программного обеспечения для управления персоналом SAP HCM, позволяющая нарушителю повысить привилегии |
| BDU:2026-00026 | Уязвимость компонента My Timesheet Fiori 2.0 программного обеспечения для управления персоналом SAP HCM, позволяющая нарушителю повысить привилегии |
| BDU:2026-00027 | Уязвимость компонента My Timesheet Fiori 2.0 программного обеспечения для управления персоналом SAP HCM, позволяющая нарушителю повысить привилегии |
| BDU:2026-00057 | Уязвимость сетевой файловой системы Network File System (NFS) операционной систем Synology DiskStation Manager, позволяющая нарушителю читать произвольные файлы |
| BDU:2026-00230 | Уязвимость программного обеспечения разработки и выполнения приложений на языке ABAP SAP NetWeaver Application Server ABAP, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-00232 | Уязвимость программной платформы SAP S/4HANA, позволяющая нарушителю выполнить произвольный код |
| BDU:2026-00233 | Уязвимость приложения для установления связи между облачной платформой и локальной системой SAP Cloud Connector, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ на изменение защищаемой информации |
| BDU:2026-00269 | Уязвимость сервера системы управления базами данных MongoDB, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2026-00279 | Уязвимость системы управления контентом на основе технологии Java OFCMS, связаная с подделкой межсайтовых запросов, позволяющая нарушителю осуществить CSRF-атаку |
| BDU:2026-00315 | Уязвимость сервера автоматизации Jenkins, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-00492 | Уязвимость программного обеспечения для онлайн-моделирования и оптимизации процессов AVEVA Process Optimization, связанная с отсутствием авторизации, позволяющая нарушителю выполнить произвольный код, получить доступ на чтение, изменение и удаление ф... |
| BDU:2026-00766 | Уязвимость приложения Business Server Pages Application, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации |
| BDU:2026-00771 | Уязвимость файла WifiScanModeActivity.java операционной системы Android, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-00774 | Уязвимость компонента IntentResolver операционной системы Android, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-00887 | Уязвимость компонента для отображения веб-страниц WebView браузера Google Chrome, позволяющая нарушителю выполнить произвольный код |
| BDU:2026-01022 | Уязвимость утилиты qemu-img агента для взаимодействия между системой Ironic и физическим оборудованием Ironic Python Agent (IPA), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-01512 | Уязвимость платформы для создания индивидуальных веб-приложений CRM Руководитель, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный код |
| BDU:2026-01625 | Уязвимость инструмента создания сценариев веб-клиента системы для управления взаимоотношениями с клиентами SAP CRM и программной платформы SAP S/4HANA, позволяющая нарушителю выполнить произвольный код и получить несанкционированный доступ к базе дан... |
| BDU:2026-02071 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab Enterprise Edition (EE), связанная с отсутствием процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к настройкам модели ИИ |
| BDU:2026-02073 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab Enterprise Edition (EE), связанная с отсутствием процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к настройкам модели ИИ |
| BDU:2026-02082 | Уязвимость многоплатформенного веб-решения для создания Scada-систем Scada-LTS, связанная с недостаточной проверкой подлинности выполняемых запросов, позволяющая нарушителю обойти ограничения безопасности и осуществить CSRF-атаку |
| BDU:2026-02141 | Уязвимость программного средства централизованного управления устройствами Fortinet FortiManager, связанная с отсутсвием авторизации, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2026-02143 | Уязвимость функций UploadIssueAttachment() и UploadReleaseAttachment() программного средства создания самоуправляемых Git-репозиториев Gogs, позволяющая нарушителю вызвать отказ в обслуживании и выполнить произвольный код |
| BDU:2026-02444 | Уязвимость платформы обработки данных Apache NiFi, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации |
| BDU:2026-02528 | Уязвимость межсетевого экрана PT NGFW, связанная с недостатком контроля доступа, позволяющая нарушителю получить несанкционированный доступ к резервным копиям MinIO |
| BDU:2026-02733 | Уязвимость компонента lanserv_ipmi.c утилиты для управления IPMI-устройствами OpenIPMI, связанная с ошибками авторизации, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании |
| BDU:2026-03234 | Уязвимость программной платформы для создания пользовательских интерфейсов поверх языковых моделей (LLM) Flowise, связанная с отсутствием аутентификации для критичной функции, позволяющая нарушителю выполнить произвольные команды |
| BDU:2026-03426 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостатками процедуры авторизации, позволяющая нарушителю обойти ограничения безопасности |
| BDU:2026-03484 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-03521 | Уязвимость системы непрерывной интеграции и доставки приложений (CI/CD) JetBrains TeamCity, связанная с отсутствием авторизации, позволяющая нарушителю получить доступ на чтение и изменение данных |
| BDU:2026-03550 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с отсутствием процедуры авторизации, позволяющая нарушителю обойти существующие механизмы безопасности |
| BDU:2026-03577 | Уязвимость системы управления базами данных MongoDB, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-04276 | Уязвимость разграничения прав доступа сервиса для управления бизнесом Битрикс24 и системы управления содержимым сайтов (CMS) 1С-Битрикс: Управление сайтом, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный досту... |
| BDU:2026-04594 | Уязвимость веб-интерфейса управления программного средства управления сетевыми сервисами Cisco Evolved Programmable Network Manager (EPNM), позволяющая нарушителю скомпрометировать уязвимое устройство |
| BDU:2026-04882 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab EE, связанная с отсутствием авторизации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-05060 | Уязвимость файла /admin/edit-user.php веб-приложения управления взаимоотношениями с клиентами PHPGurukul Small CRM, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2026-05092 | Уязвимость системы для ведения медицинской документации OpenEMR, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2026-05093 | Уязвимость системы для ведения медицинской документации OpenEMR, связанная с неправильным порядком поведения, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-05150 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с некорректной авторизацией, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-05293 | Уязвимость платформы создания совместных веб-приложений XWiki Platform, связанная с отсутствием авторизации, позволяющая нарушителю повлиять на целостность, доступность и конфиденциальность информации |
| BDU:2026-05417 | Уязвимость программных платформ SAP S/4HANA и SAP ERP, связанная с недостатками процедуры авторизации, позволяющая нарушителю оказать влияние на целостность и доступность защищаемой информации |
| BDU:2026-05442 | Уязвимость платформы бизнес-аналитики SAP Business Analytics и CMS-системы SAP Content Management, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-05448 | Уязвимость службы OData Service программной платформы SAP S/4HANA, позволяющая нарушителю получить доступ на чтение, изменение и удаление данных |
| BDU:2026-05594 | Уязвимость системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI связана с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-05615 | Уязвимость сетевого программного средства Apache Airflow, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к рабочим процессам HITL |
| BDU:2026-05630 | Уязвимость приложения для обмена мгновенными сообщениями Mattermost, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ на изменение защищаемой информации |
| BDU:2026-06571 | Уязвимость приложения для обмена мгновенными сообщениями Mattermost, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-06573 | Уязвимость приложения для обмена мгновенными сообщениями Mattermost, связанная с отсутствием авторизации, позволяющая нарушителю обойти существующие механизмы безопасности |
| BDU:2026-06593 | Уязвимость средства управления серверами Windows Admin Center, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-06727 | Уязвимость команды KILL_CLIENT программного обеспечения для пула соединения в PostgreSQL PgBouncer, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2026-06920 | Уязвимость платформы для автоматизации рабочих процессов N8n, связанная с недостатками процедуры авторизации, позволяющая нарушителю повторно использовать внешний ключ API и получить несанкционированный доступ к защищаемой информации |
| BDU:2026-06921 | Уязвимость функции Hosted Chat узла Chat Trigger платформы для автоматизации рабочих процессов N8n, позволяющая нарушителю получить несанкционированный доступ на чтение и изменение защищаемой информации |
| BDU:2026-07014 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с отсутствием авторизации, позволяющая нарушителю оказать воздействие на целостность защищаемой информации |
| BDU:2026-07030 | Уязвимость системы управления контентом Craft CMS, связанная с отсутствием авторизации, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-07039 | Уязвимость интерфейса Snapshot API платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю получить доступ на чтение и удаление данных |
| BDU:2026-07090 | Уязвимость функции map_keys_roles() подсистемы ролевого управления доступом RBAC гипервизора XCP-ng и платформы для серверной виртуализации XenServer, позволяющая нарушителю обойти существующие механизмы безопасности |
| BDU:2026-07103 | Уязвимость команды CREATE TYPE системы управления базами данных PostgreSQL, позволяющая нарушителю выполнять произвольные SQL-функции |
| BDU:2026-07143 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с отсутствием авторизации, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2026-07174 | Уязвимость агента удаленного доступа пользователей к корпоративным ресурсам и приложениям Prisma Access Agent, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии, получить доступ на чтение данных и выполни... |
| BDU:2026-07188 | Уязвимость функции get_tool_by_id() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07192 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с отсутствием авторизации, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2026-07197 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с отсутствием проверки разрешений, позволяющая нарушителю получить доступ на чтение, изменение данных, повысить свои привилегии и выполнить произвольный код |
| BDU:2026-07302 | Уязвимость платформы создания совместных веб-приложений XWiki Platform XWiki, связанная с отсутствием авторизации, позволяющая нарушителю создать или изменить произвольные файлы |
| BDU:2026-07482 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07490 | Уязвимость интерфейса Duo Workflows API программной платформы на базе git для совместной работы над кодом GitLab EE, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2026-07553 | Уязвимость системы управления производством DELMIA Apriso, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить привилегированный доступ к приложению |
| BDU:2026-07620 | Уязвимость обучающей платформы IQ SCHOOL, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07723 | Уязвимость класса GenericInlineModelAdmin фреймворка для веб-разработки Django, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07724 | Уязвимость фреймворка для веб-разработки Django, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07769 | Уязвимость модуля "Yandex SpeechKit" системы управления содержимым сайтов (CMS) 1С-Битрикс: Управление сайтом, связанная с отсутствием аутентификации для критичной функции, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность... |
| BDU:2026-07859 | Уязвимость платформы управления жизненным циклом моделей машинного обучения MLflow, связанная с недостатками процедуры авторизации, позволяющая нарушителю выполнить произвольный код |
| BDU:2026-07887 | Уязвимость системы выявления и устранения угроз FortiSandbox, связанная с отсутствием авторизации, позволяющая нарушителю выполнить произвольный код |
| BDU:2026-07989 | Уязвимость программного средства для управления инфраструктурой центра обработки данных openDCIM, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-08303 | Уязвимость редактора исходного кода Microsoft Visual Studio Code, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-08480 | Уязвимость функций editUser() и updateUserRights() веб-приложения phpMyFAQ, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-08526 | Уязвимость инструмента оркестрации Docker Swarm платформы управления контейнерами Portainer, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-08529 | Уязвимость функции decorateContainerCreationOperation() платформы управления контейнерами Portainer, позволяющая нарушителю получить доступ на чтение и изменение данных |
| BDU:2026-08531 | Уязвимость интерфейса Docker API платформы управления контейнерами Portainer, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код |
| BDU:2026-08548 | Уязвимость системы для автоматизации ИТ- и бизнес-процессов Naumen Service Management Platform, связанная с отсутствием авторизации, позволяющая нарушителю выполнить произвольный код |
| BDU:2026-08549 | Уязвимость программного обеспечения выявления уязвимостей и ошибок PT Application Inspector, связанная с отсутствием авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-08665 | Уязвимость интерфейса командной строки операционной системы PAN-OS межсетевых экранов серии PA-Series, VM-Series и виртуальных устройств серии M-Series, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-08905 | Уязвимость облачной службы корпоративной почты Microsoft Exchange Online, связанная с отсутствием авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-08939 | Уязвимость модуля Remote Function Call (RFC) инфраструктуры для извлечения и репликации данных SAP Operational Data Provisioning Data Replication API (ODP-RFC), позволяющая нарушителю раскрыть защищаемую информацию или вызвать отказ в обслуживании |
| BDU:2026-08940 | Уязвимость сервера приложений ABAP программных интеграционных платформ SAP NetWeaver AS ABAP и SAP ABAP Platform, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-08942 | Уязвимость компонента Review Match Groups Application платформы управления данными SAP Master Data Governance, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-09013 | Уязвимость микропрограммного обеспечения коммутаторов Zyxel серии GS1200, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-09073 | Уязвимость механизма Rapid Diffs программной платформы на базе git для совместной работы над кодом GitLab EE/ CE, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-09074 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab EE, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-09079 | Уязвимость службы OData программной платформы SAP S/4HANA, позволяющая нарушителю нарушить целостность защищаемой информации |
| BDU:2026-09084 | Уязвимость программной платформы SAP S/4HANA, связанная с отсутствием авторизации, позволяющая нарушителю нарушить целостность защищаемой информации |
| BDU:2026-09103 | Уязвимость функции customTemplateFile() платформы управления контейнерами Portainer, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-09122 | Уязвимость программной платформы Dell Automation Platform, связанная с отсутствием процедуры авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-09139 | Уязвимость компонента Generic Interface программного обеспечения для быстрого отображения и доступа к информации о клиентах Znuny, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации |
| BDU:2026-09644 | Уязвимость веб-интерфейса на базе искусственного интеллекта Open WebUI, связанная с отсутствием проверки разрешений, позволяющая нарушителю получить доступ на чтение, изменение данных, повысить свои привилегии |
| BDU:2026-09663 | Уязвимость функции get_sources_from_items() веб-интерфейса на базе искусственного интеллекта Open WebUI, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-09664 | Уязвимость веб-интерфейса на базе искусственного интеллекта Open WebUI, связанная с отсутствием авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-09665 | Уязвимость функции filter_allowed_access_grants() веб-интерфейса на базе искусственного интеллекта Open WebUI, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-09666 | Уязвимость веб-интерфейса на базе искусственного интеллекта Open WebUI, связанная с отсутствием авторизации, позволяющая нарушителю получить доступ на чтение, изменение и удаление данных |
| BDU:2026-09680 | Уязвимость прокси-сервера Ollama веб-интерфейса на базе искусственного интеллекта Open WebUI, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-09681 | Уязвимость микропрограммного обеспечения Wi-Fi роутеров ZTE MU5250, связанная с недостаточной защитой служебных данных, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-09847 | Уязвимость механизма отображения обсуждений коммитов и межпроектных ссылок программной платформы на базе git для совместной работы над кодом GitLab CE/EE, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2026-09848 | Уязвимость механизма проверки прав доступа к метаданным рабочих элементов приватных проектов программной платформы на базе git для совместной работы над кодом GitLab EE, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой инфо... |
| BDU:2026-10563 | Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-10566 | Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-10769 | Уязвимость API отчётов о тестировании CI/CD-конвейеров Pipeline Test Report API программной платформы на базе git для совместной работы над кодом GitLab CE/EE, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2026-10770 | Уязвимость обработчика конфигурации защищённых веток Protected Branches программной платформы на базе git для совместной работы над кодом GitLab CE/EE, позволяющая нарушителю изменить конфигурацию защищенного филиала |
| BDU:2026-11138 | Уязвимость веб-приложения для управления активами центров обработки данных RackTables, связанная с подделкой межсайтовых запросов, позволяющая нарушителю осуществить CSRF-атаку |
| BDU:2026-11306 | Уязвимость функции install_and_activate_plugin_from_external() плагина GutenKit - Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor системы управления содержимым сайта WordPress, позволяющая нарушителю загружать произвольные фай... |
| BDU:2026-11459 | Уязвимость корпоративной платформы Microsoft Teams, связанная с отсутствием авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-11468 | Уязвимость инструмента на базе искусственного интеллекта для автоматического анализа первопричин и эффективного реагирования на инциденты Azure SRE Agent, связанная с отсутствием авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-11948 | Уязвимость функции Verify() языка программирования Go, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-11950 | Уязвимость функции NewKeyring() языка программирования Go, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-11976 | Уязвимость DDL-команд системы управления базами данных PostgreSQL, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2026-11977 | Уязвимость механизма логического декодирования (logical decoding) системы управления базами данных PostgreSQL, позволяющая нарушителю выполнить произвольный код |
| BDU:2026-12611 | Уязвимость компонента register.php веб-приложения phpMyFAQ, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2026-13299 | Уязвимость сервиса input-remapper.service инструмента для управления устройствами ввода input-remapper, позволяющая нарушителю переключить сервис на указанный конфигурационный каталог и запустить механизм инъекции ввода |
| BDU:2026-13478 | Уязвимость функции deleteMessages() платформы на базе искуственного интеллекта LibreChat, позволяющая нарушителю получить доступ на удаление произвольных файлов |
| BDU:2026-13567 | Уязвимость компонента StorageAccessAPI веб-браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю оказать воздействие на целостность данных |
| BDU:2026-13635 | Уязвимость функции TendaTelnet() файла /goform/telnet компонента Web UI микропрограммного обеспечения маршрутизаторов Tenda AC1206, позволяющая нарушителю получить полный контроль над системой |
| BDU:2026-14040 | Уязвимость функции set_course_mode_price() платформы онлайн-обучения Open edX Platform, позволяющая нарушителю получить доступ на чтение и изменение данных |
| BDU:2026-14365 | Уязвимость программного обеспечения для безопасного обмена и передачи файлов SolarWinds Serv-U, связанная с недостатками процедуры авторизации, позволяющая нарушителю создавать учетные записи администраторов |
| BDU:2026-14366 | Уязвимость программного обеспечения для безопасного обмена и передачи файлов SolarWinds Serv-U, связанная с недостатками процедуры авторизации, позволяющая нарушителю повысить свои привилегии до уровня системного администратора |
| BDU:2026-14439 | Уязвимость пакета для обеспечения совместимости Microsoft Azure Entra ID, связанная с отсутствием авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-14548 | Уязвимость API привязки репозиториев к командам системы управления Git-репозиториями Gitea, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-14552 | Уязвимость платформы для управления данными Microsoft Fabric, связанная с отсутствием авторизации, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-14595 | Уязвимость модуля RFC программного обеспечения разработки и выполнения приложений на языке ABAP SAP NetWeaver Application Server ABAP, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-14599 | Уязвимость программных интеграционных платформ SAP NetWeaver Application Server ABAP, связанная с отсутствием процедуры авторизации, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации |
| BDU:2026-14602 | Уязвимость модуля RFC системы управления данными и аналитики SAP Business Warehouse, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2026-14603 | Уязвимость программных интеграционных платформ SAP NetWeaver Application Server ABAP, связанная с отсутствием процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ на чтение защищаемой информации |
| BDU:2026-14604 | Уязвимость функционального модуля программного компонента диагностики системы SAP Solution Manager SAP Solution Tools Plug-In (ST-PI), позволяющая нарушителю раскрыть защищаемую информацию |
Идентификаторы CVE уязвимостей
Идентификатор, базы данных общеизвестных уязвимостей информационной безопасности
| Идентификатор | Описание |
|---|---|
| CVE-2011-4183 | open build service allows anyone to upload rpms |
| CVE-2013-10072 | Nagios XI < 2012R1.6 Auto-Discovery Missing Authorization |
| CVE-2013-3703 | No write permission check in change_role command |
| CVE-2015-10140 | Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion |
| CVE-2015-10143 | Platform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update |
| CVE-2015-20067 | WP Attachment Export < 0.2.4 - Unauthenticated Posts Download |
| CVE-2017-2652 | It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jen... |
| CVE-2017-2662 | A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a reposito... |
| CVE-2017-7530 | In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when... |
| CVE-2017-7548 | PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attacke... |
| CVE-2018-10865 | It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allow... |
| CVE-2018-10866 | It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allow... |
| CVE-2018-14628 | An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticat... |
| CVE-2018-25019 | LearnDash < 2.5.4 - Unauthenticated Arbitrary File Upload |
| CVE-2018-25105 | File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download |
| CVE-2018-25391 | HaPe PKH 1.1 Missing Authorization Allows Unauthenticated Record Deletion |
| CVE-2018-7688 | Open Build Service accepts arbitrary reviews |
| CVE-2018-7689 | Open Build Service arbitrary package modification |
| CVE-2019-10184 | undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures... |
| CVE-2019-13547 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP a... |
| CVE-2019-14822 | A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to... |
| CVE-2019-18581 | Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71... |
| CVE-2019-25139 | Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset |
| CVE-2019-25141 | Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update |
| CVE-2019-25142 | Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update |
| CVE-2019-25143 | GDPR Cookie Compliance <= 4.0.2 - Missing Authorization |
| CVE-2019-25214 | ShopWP <= 2.0.4 - Missing Authorization to Stored Cross-Site Scripting |
| CVE-2019-25215 | ARI-Adminer <= 1.1.14 - Missing Authorization and No Direct File Access Restrictions |
| CVE-2019-25217 | SiteGround Optimizer <= 5.0.12 - Missing Authorization |
| CVE-2019-25351 | Centova Cast 3.2.11 - Arbitrary File Download |
| CVE-2019-3879 | It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command,... |
| CVE-2019-3886 | An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs... |
| CVE-2019-6580 | A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions... |
| CVE-2020-10684 | A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when u... |
| CVE-2020-10689 | A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An auth... |
| CVE-2020-10697 | A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can... |
| CVE-2020-10701 | A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw... |
| CVE-2020-10746 | A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to contro... |
| CVE-2020-14306 | An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through... |
| CVE-2020-14491 | OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a... |
| CVE-2020-14520 | The affected product is vulnerable to an information leak, which may allow an attacker to obtain sensitive information on the... |
| CVE-2020-15247 | Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. |
| CVE-2020-1996 | PAN-OS: Panorama management server log injection |
| CVE-2020-24672 | ABB Base Software for SoftControl Remote Code Execution vulnerability |
| CVE-2020-25711 | A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server mana... |
| CVE-2020-25718 | A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain con... |
| CVE-2020-26212 | Any GLPI CalDAV calendars is read-only for every authenticated user |
| CVE-2020-26231 | Bypass of fix for CVE-2020-15247, Twig sandbox escape |
| CVE-2020-27220 | The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receiv... |
| CVE-2020-27349 | aptdaemon performed policykit permissions checks too late |
| CVE-2020-27777 | A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due... |
| CVE-2020-28215 | A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide range... |
| CVE-2020-3400 | Cisco IOS XE Software Web UI Authorization Bypass Vulnerability |
| CVE-2020-36239 | Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8... |
| CVE-2020-36667 | JetBackup – WP Backup, Migrate & Restore <= 1.4.1 - Missing Authorization to Unauthorized Backup Location Change |
| CVE-2020-36670 | NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actions |
| CVE-2020-36697 | WP GDPR <= 2.1.1 - Missing Authorization Checks |
| CVE-2020-36698 | Security & Malware scan by CleanTalk <= 2.50 - Missing Authorization |
| CVE-2020-36702 | Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization |
| CVE-2020-36712 | Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion |
| CVE-2020-36715 | Login/Signup Popup < 1.5 - Missing Authorization |
| CVE-2020-36716 | WP Activity Log <= 4.0.1 - Missing Authorization |
| CVE-2020-36719 | ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation |
| CVE-2020-36720 | Kali Forms <= 2.1.1 - Missing Authorization to Settings Update |
| CVE-2020-36725 | TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update |
| CVE-2020-36730 | CMP <= 3.8.1 - Missing Authorization |
| CVE-2020-36833 | Indeed Membership Pro 7.3 - 8.6 - Missing Authorization Checks |
| CVE-2020-36834 | Discount Rules for WooCommerce <= 2.0.2 - Missing Authorization |
| CVE-2020-36837 | ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset |
| CVE-2020-36840 | Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization |
| CVE-2020-36852 | Custom Searchable Data Entry System <= 1.7.1 - Unauthenticated Database Wiping |
| CVE-2020-36890 | Kentico Xperience <= 10 Administrator Access Control Bypass |
| CVE-2020-36902 | UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges |
| CVE-2020-5228 | Opencast allows unauthorized public access via OAI-PMH |
| CVE-2020-5368 | Dell EMC VxRail versions 4.7.410 and 4.7.411 contain an improper authentication vulnerability. A remote unauthenticated attac... |
| CVE-2020-7343 | Improper Authorization vulnerability in MA |
| CVE-2021-21246 | Pre-Auth Access token leak |
| CVE-2021-21255 | entities switch IDOR |
| CVE-2021-21264 | Bypass of fix for CVE-2020-26231, Twig sandbox escape |
| CVE-2021-21307 | Remote Code Exploit in Lucee Admin |
| CVE-2021-21326 | Horizontal Privilege Escalation |
| CVE-2021-21327 | Unsafe Reflection in getItemForItemtype() |
| CVE-2021-22513 | Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability af... |
| CVE-2021-22891 | A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.10.1... |
| CVE-2021-22896 | Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticat... |
| CVE-2021-24184 | Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation |
| CVE-2021-24352 | Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Export |
| CVE-2021-24353 | Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Import |
| CVE-2021-24354 | Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation |
| CVE-2021-24355 | Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard Value |
| CVE-2021-24356 | Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation |
| CVE-2021-24500 | Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities |
| CVE-2021-24501 | Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions |
| CVE-2021-24633 | Countdown Block < 1.1.2 - Missing Authorisation in AJAX action |
| CVE-2021-24639 | OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion |
| CVE-2021-24677 | Find My Blocks < 3.4.0 - Private Post Titles Disclosure |
| CVE-2021-24730 | Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update |
| CVE-2021-24779 | WP Debugging < 2.11.0 - Unauthenticated Plugin's Settings Update |
| CVE-2021-24790 | Contact Form Advanced Database <= 1.0.8 - Unauthorised AJAX Calls |
| CVE-2021-24831 | Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls |
| CVE-2021-24836 | Temporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings Update |
| CVE-2021-24839 | SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion |
| CVE-2021-24842 | Bulk Datetime Change < 1.12 - Missing Authorisation |
| CVE-2021-24890 | Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload |
| CVE-2021-24906 | Protect WP Admin < 3.6.2 - Unauthenticated Plugin Deactivation |
| CVE-2021-24914 | Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal |
| CVE-2021-24950 | Insight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSS |
| CVE-2021-24968 | Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ Creation |
| CVE-2021-24977 | Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Appending |
| CVE-2021-24978 | OSMapper <= 2.1.5 - Unauthenticated Arbitrary Post Deletion |
| CVE-2021-24993 | Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update |
| CVE-2021-24997 | WP Guppy < 1.3 - Sensitive Information Disclosure |
| CVE-2021-25002 | Tipsacarrier < 1.5.0.5 - Unauthenticated Orders Disclosure |
| CVE-2021-25011 | WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update |
| CVE-2021-25013 | Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion |
| CVE-2021-25014 | Ibtana < 1.1.4.9 - Subscriber+ Settings Update to Stored XSS |
| CVE-2021-25018 | PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSS |
| CVE-2021-25025 | Event Calendar < 1.1.51 - Subscriber+ Event Creation |
| CVE-2021-25032 | PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise |
| CVE-2021-25042 | WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSS |
| CVE-2021-25075 | Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS |
| CVE-2021-25084 | Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion |
| CVE-2021-25087 | Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure |
| CVE-2021-25093 | Link Library < 7.2.8 - Unauthenticated Arbitrary Links Deletion |
| CVE-2021-25095 | IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban |
| CVE-2021-25116 | Enqueue Anything <= 1.0.1 - Subscriber+ Arbitrary Asset/Post Deletion |
| CVE-2021-27855 | FatPipe software allows privilege escalation |
| CVE-2021-27857 | FatPipe software allows unauthenticated configuration download |
| CVE-2021-27858 | Missing authorization vulnerability in FatPipe software |
| CVE-2021-27859 | Missing authorization vulnerability in FatPipe software |
| CVE-2021-31384 | Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from... |
| CVE-2021-32472 | Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle version... |
| CVE-2021-32503 | Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only... |
| CVE-2021-32504 | Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only... |
| CVE-2021-32748 | WOPI API not protected by credentials/IP check |
| CVE-2021-33704 | The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that woul... |
| CVE-2021-34629 | SendGrid <= 1.11.8 – Authorization Bypass |
| CVE-2021-35001 | BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability |
| CVE-2021-3653 | A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (vi... |
| CVE-2021-3656 | A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (vi... |
| CVE-2021-3814 | It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth ins... |
| CVE-2021-38164 | SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618,... |
| CVE-2021-38431 | Advantech WebAccess SCADA |
| CVE-2021-39231 | Missing authentication/authorization on internal RPC endpoints |
| CVE-2021-39232 | Missing admin check for SCM related admin commands |
| CVE-2021-39236 | Owners of the S3 tokens are not validated |
| CVE-2021-39347 | Stripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account Hijacking |
| CVE-2021-40501 | SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authentica... |
| CVE-2021-40502 | SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticat... |
| CVE-2021-4074 | WHMCS Bridge <= 6.1 Subscriber+ Stored Cross-Site Scripting |
| CVE-2021-40853 | TCMAN GIM missing authorization vulnerability |
| CVE-2021-41112 | Missing Authorization in Rundeck |
| CVE-2021-41233 | Missing authorization in Nextcloud text |
| CVE-2021-41238 | Missing Authorization with Default Settings in Dashboard UI |
| CVE-2021-42062 | SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in... |
| CVE-2021-42367 | Variation Swatches for WooCommerce <= 2.1.1 Authenticated Stored Cross-Site Scripting |
| CVE-2021-42848 | An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauth... |
| CVE-2021-42851 | A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create... |
| CVE-2021-4331 | The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege... |
| CVE-2021-4337 | Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization |
| CVE-2021-4339 | uListing <= 1.6.6 - Unauthenticated Information Disclosure |
| CVE-2021-4341 | uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX |
| CVE-2021-4343 | uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation |
| CVE-2021-4345 | uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion |
| CVE-2021-4346 | uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes |
| CVE-2021-4347 | Advanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options Change |
| CVE-2021-4348 | Ultimate GDPR & CCPA <= 2.4 - Unauthenticated Settings Import & Export |
| CVE-2021-4350 | Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails |
| CVE-2021-4351 | Frontend File Manager <= 18.2 - Unauthenticated Post Meta Change |
| CVE-2021-4355 | Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure |
| CVE-2021-4356 | Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download |
| CVE-2021-4357 | uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion |
| CVE-2021-4359 | Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion |
| CVE-2021-4366 | PWA for WP & AMP < = 1.7.32 - Missing Authorization |
| CVE-2021-4368 | Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload |
| CVE-2021-4369 | Frontend File Manager <= 18.2 - Unauthenticated Content Injection |
| CVE-2021-4370 | uListing <= 1.6.6 - Missing Authorization |
| CVE-2021-4371 | WP Quick FrontEnd Editor <= 5.5 - Authenticated Settings Change |
| CVE-2021-4374 | WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update |
| CVE-2021-4375 | Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure |
| CVE-2021-4376 | WooCommerce Multi Currency <= 2.1.17 - Missing Authorization |
| CVE-2021-43781 | Permissions not properly checked in Invenio-Drafts-Resources |
| CVE-2021-4379 | WooCommerce Multi Currency <= 2.1.17 - Missing Authorization |
| CVE-2021-4381 | uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route |
| CVE-2021-4383 | WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Content Injection |
| CVE-2021-4388 | Opal Estate <= 1.6.11 - Missing Authorization |
| CVE-2021-44055 | Information leakage in Video Station |
| CVE-2021-44233 | SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an aut... |
| CVE-2021-4444 | Product Filter by WooBeWoo <= 1.4.9 - Missing Authorization |
| CVE-2021-4445 | Premium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update |
| CVE-2021-4446 | Essential Addons for Elementor <= 4.6.4 - Missing Authorization |
| CVE-2021-4447 | Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation |
| CVE-2021-4448 | Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization |
| CVE-2021-44792 | Information Leakege via Unauthorized Access in Single Connect |
| CVE-2021-44793 | Information Leakege via Unauthorized Access in Single Connect |
| CVE-2021-44794 | Information Leakege via Unauthorized Access in Single Connect |
| CVE-2021-44795 | Modifying User Permissions via Unauthorized Access in Single Connect |
| CVE-2021-47662 | Unauthenticated remote shutdown of the cobot |
| CVE-2021-47701 | OpenBMCS User Management Privilege Escalation |
| CVE-2021-47812 | GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) |
| CVE-2021-47932 | WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated |
| CVE-2022-0163 | Smart Forms < 2.6.71 - Subscriber+ Form Data Download |
| CVE-2022-0164 | Coming soon and Maintenance mode < 3.6.7 - Subscriber+ Arbitrary Email Sending to Subscribed Users |
| CVE-2022-0178 | Missing Authorization in snipe/snipe-it |
| CVE-2022-0179 | Missing Authorization in snipe/snipe-it |
| CVE-2022-0218 | WP HTML Mail <= 3.0.9 Missing Authorization on REST-API Route |
| CVE-2022-0229 | miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion |
| CVE-2022-0236 | WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosure |
| CVE-2022-0287 | Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure |
| CVE-2022-0345 | Better Notifications for WP < 1.8.7 - Email Address Disclosure |
| CVE-2022-0363 | myCred < 2.4.4 - Subscriber+ Arbitrary Post Creation |
| CVE-2022-0398 | ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation |
| CVE-2022-0404 | Material Design for Contact Form 7 <= 2.6.4 - Subscriber+ Arbitrary Settings Update leading to DoS |
| CVE-2022-0444 | XCloner < 4.3.6 - Plugin Settings Reset |
| CVE-2022-0579 | Missing Authorization in snipe/snipe-it |
| CVE-2022-0588 | Missing Authorization in librenms/librenms |
| CVE-2022-0611 | Missing Authorization in snipe/snipe-it |
| CVE-2022-0634 | ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF |
| CVE-2022-0726 | Missing Authorization in chocobozzz/peertube |
| CVE-2022-0745 | Like Button Rating < 2.6.45 - Arbitrary e-mail Sending |
| CVE-2022-0755 | Missing Authorization in salesagility/suitecrm |
| CVE-2022-0756 | Missing Authorization in salesagility/suitecrm |
| CVE-2022-0833 | Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure |
| CVE-2022-0837 | Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure |
| CVE-2022-0871 | Missing Authorization in gogs/gogs |
| CVE-2022-0885 | Member Hero <= 1.0.9 - Unauthenticated RCE |
| CVE-2022-0905 | Missing Authorization in go-gitea/gitea |
| CVE-2022-0919 | Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure |
| CVE-2022-0932 | Missing Authorization in saleor/saleor |
| CVE-2022-0952 | Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update |
| CVE-2022-1020 | Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call |
| CVE-2022-1054 | RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export |
| CVE-2022-1092 | myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure |
| CVE-2022-1203 | Content Mask < 1.8.4.1 - Subscriber+ Arbitrary Options Update |
| CVE-2022-1245 | A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client applic... |
| CVE-2022-1323 | Discy < 5.0 - Subscriber+ Broken Access Control to change settings |
| CVE-2022-1329 | Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution |
| CVE-2022-1442 | Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure |
| CVE-2022-1511 | Missing Authorization in snipe/snipe-it |
| CVE-2022-1570 | Files Download Delay < 1.0.7 - Subscriber+ Settings Reset |
| CVE-2022-1572 | HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion |
| CVE-2022-1574 | HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload |
| CVE-2022-1777 | Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls |
| CVE-2022-1903 | ARMember < 3.4.8 - Unauthenticated Admin Account Takeover |
| CVE-2022-2108 | Wbcom Designs – BuddyPress Group Reviews <= 2.8.3 - Unauthorized AJAX Actions due to Nonce Bypass |
| CVE-2022-21660 | Missing authorization in gin-vue-admin |
| CVE-2022-21953 | Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster |
| CVE-2022-22107 | DayByDay CRM - Missing Authorization when Viewing Appointments |
| CVE-2022-22108 | DayByDay CRM - Missing Authorization when Viewing Absences |
| CVE-2022-22111 | DayByDay CRM - Missing Authorization when Changing Password |
| CVE-2022-22535 | SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the pa... |
| CVE-2022-2276 | WP Edit Menu < 1.5.0 - Unauthenticated Arbitrary Post Deletion |
| CVE-2022-23055 | ERPNext - Improper user access conrol |
| CVE-2022-23180 | Contact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings Update |
| CVE-2022-2350 | Disable User Login <= 1.0.1 - Unauthenticated Settings Update |
| CVE-2022-23617 | Missing authorization in xwiki-platform |
| CVE-2022-23621 | Missing authorization in xwiki-platform |
| CVE-2022-2369 | YaySMTP < 2.2.1 - Subscriber+ Logs Disclosure |
| CVE-2022-2370 | YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak |
| CVE-2022-2373 | Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure |
| CVE-2022-2376 | Directorist < 7.3.1 - Unauthenticated Email Address Disclosure |
| CVE-2022-2377 | Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending |
| CVE-2022-2379 | Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST API |
| CVE-2022-2382 | Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion |
| CVE-2022-2389 | Automations By Autonami < 2.1.2 - Subscriber+ Automation Creation |
| CVE-2022-23944 | Apache ShenYu 2.4.1 Improper access control |
| CVE-2022-23945 | Apache ShenYu missing authentication allows gateway registration |
| CVE-2022-2405 | WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion |
| CVE-2022-24317 | A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific... |
| CVE-2022-2450 | reSmush.it Image Optimizer < 0.4.4 - Subscriber+ AJAX Calls |
| CVE-2022-2461 | Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change |
| CVE-2022-24669 | Anonymous users can register / de-register for configuration change notifications |
| CVE-2022-24896 | Tracker report renderer and chart widgets leak information in Tuleap |
| CVE-2022-2543 | Visual Portfolio < 2.18.0 - Unauthenticated CSS Injection |
| CVE-2022-2552 | Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure |
| CVE-2022-25810 | Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls |
| CVE-2022-26102 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authen... |
| CVE-2022-26103 | Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access informat... |
| CVE-2022-2657 | Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls |
| CVE-2022-2696 | Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.0 - Missing Authorization on AJAX Actions |
| CVE-2022-2732 | Missing Authorization in openemr/openemr |
| CVE-2022-27480 | A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80)... |
| CVE-2022-27658 | Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead... |
| CVE-2022-27669 | An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - versio... |
| CVE-2022-2841 | CrowdStrike Falcon Uninstallation authorization |
| CVE-2022-2846 | Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS |
| CVE-2022-28789 | Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interaction. T... |
| CVE-2022-29176 | Unauthorized gem takeover for some gems on rubygems.org |
| CVE-2022-29611 | SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticate... |
| CVE-2022-2985 | In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no... |
| CVE-2022-2987 | Ldap WP Login / Active Directory Integration < 3.0.2 - Unauthenticated Settings Update to Auth Bypass |
| CVE-2022-3007 | Unauthorized Access Vulnerability in Syska SW100 Smartwatch |
| CVE-2022-30731 | Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private f... |
| CVE-2022-3082 | miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling |
| CVE-2022-3096 | WP Total Hacks <= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSS |
| CVE-2022-31128 | Fine grained permissions are not checked in Tuleap |
| CVE-2022-31167 | XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same re... |
| CVE-2022-3124 | Frontend File Manager < 21.3 - Unauthenticated File Renaming |
| CVE-2022-31592 | The application SAP Enterprise Extension Defense Forces & Public Security - versions 605, 606, 616,617,618, 802, 803, 804, 80... |
| CVE-2022-31595 | SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, result... |
| CVE-2022-31597 | Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension f... |
| CVE-2022-31765 | Affected devices do not properly authorize the change password function of the web interface. This could allow low privilege... |
| CVE-2022-3244 | Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation |
| CVE-2022-32768 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev mas... |
| CVE-2022-32769 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev mas... |
| CVE-2022-32966 | Realtek RTL8111FP-CG - Missing Authorization |
| CVE-2022-3320 | Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command |
| CVE-2022-3321 | Lock WARP switch feature bypass on WARP mobile client for iOS |
| CVE-2022-3322 | Lock WARP switch bypass on WARP mobile client using iOS quick action |
| CVE-2022-3337 | Lock WARP switch bypass by removing VPN profile on iOS mobile client |
| CVE-2022-34344 | WordPress Wholesale Suite Plugin <= 2.1.5 is vulnerable to Broken Access Control |
| CVE-2022-3451 | Product Stock Manager < 1.0.5 - Subscriber+ Unauthorised AJAX Calls |
| CVE-2022-3489 | WP Hide <= 0.0.2 - Unauthenticated Settings Update |
| CVE-2022-3512 | Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command |
| CVE-2022-35293 | Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On su... |
| CVE-2022-3538 | Webmaster Tools Verification <= 1.2 - Unauthenticated Arbitrary Plugin Deactivation |
| CVE-2022-36024 | Bots using py-cord as discord api wrapper are vulnerable to shutdowns through remote code execution |
| CVE-2022-36068 | Discourse moderators can edit themes via the API |
| CVE-2022-36091 | XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthori... |
| CVE-2022-3622 | Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2022-36340 | WordPress MailOptin plugin <= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion vulnerability |
| CVE-2022-36352 | WordPress ProfileGrid Plugin <= 5.0.3 is vulnerable to Broken Access Control |
| CVE-2022-36404 | WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerability |
| CVE-2022-36418 | WordPress HREFLANG Tags Lite Plugin <= 2.0.0 is vulnerable to Broken Authentication |
| CVE-2022-36836 | Unprotected provider vulnerability in Charm by Samsung prior to version 1.2.3 allows attackers to read connection state witho... |
| CVE-2022-38057 | WordPress TH Advance Product Search plugin <= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerability |
| CVE-2022-38141 | WordPress Sales Report Email for WooCommerce Plugin <= 2.8 is vulnerable to Broken Access Control |
| CVE-2022-38669 | In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service... |
| CVE-2022-38670 | In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service... |
| CVE-2022-38678 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with... |
| CVE-2022-38682 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with... |
| CVE-2022-38683 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with... |
| CVE-2022-38684 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with... |
| CVE-2022-38697 | In messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service... |
| CVE-2022-38698 | In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with... |
| CVE-2022-39080 | In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with... |
| CVE-2022-39090 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39091 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39092 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39093 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39094 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39095 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39096 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39097 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39098 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39099 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39100 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39101 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39102 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-39103 | In Gallery service, there is a missing permission check. This could lead to local denial of service in Gallery service with n... |
| CVE-2022-39104 | In contacts service, there is a missing permission check. This could lead to local denial of service in Contacts service with... |
| CVE-2022-39107 | In Soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in Soundrecorder ser... |
| CVE-2022-39108 | In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no add... |
| CVE-2022-39109 | In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no add... |
| CVE-2022-3911 | iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin |
| CVE-2022-39110 | In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no add... |
| CVE-2022-39111 | In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no add... |
| CVE-2022-39112 | In Music service, there is a missing permission check. This could lead to local denial of service in Music service with no ad... |
| CVE-2022-39113 | In Music service, there is a missing permission check. This could lead to local denial of service in Music service with no ad... |
| CVE-2022-39114 | In Music service, there is a missing permission check. This could lead to local denial of service in Music service with no ad... |
| CVE-2022-39115 | In Music service, there is a missing permission check. This could lead to local denial of service in Music service with no ad... |
| CVE-2022-39117 | In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional... |
| CVE-2022-39119 | In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional... |
| CVE-2022-3920 | Consul Peering Imported Nodes/Services Leak |
| CVE-2022-3923 | ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup |
| CVE-2022-39233 | Tuleap subject to Missing Authorization allowing for branch prefix modification |
| CVE-2022-3946 | Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion |
| CVE-2022-3961 | Directorist < 7.4.4 - Subscriber+ Sensitive Information Disclosure |
| CVE-2022-39861 | Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without... |
| CVE-2022-3999 | WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion |
| CVE-2022-4004 | Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam |
| CVE-2022-40203 | WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.1.5 is vulnerable to Broken Access Control |
| CVE-2022-40218 | WordPress TH Advance Product Search plugin <= 1.1.4 - Unauthenticated Plugin Settings Change vulnerability |
| CVE-2022-40223 | WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerability |
| CVE-2022-4024 | Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User Deletion |
| CVE-2022-40702 | WordPress Advanced Local Pickup for WooCommerce Plugin <= 1.5.2 is vulnerable to Broken Access Control |
| CVE-2022-40975 | WordPress Post Slider plugin <= 1.6.7 - Broken Access Control vulnerability |
| CVE-2022-4102 | Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Deletion |
| CVE-2022-4103 | Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Creation |
| CVE-2022-4124 | Popup Manager <= 1.6.6 - Unauthenticated Arbitrary Popup Deletion |
| CVE-2022-41271 | An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process... |
| CVE-2022-41272 | An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search... |
| CVE-2022-4148 | WP OAuth Server < 4.3.0 - Subscriber+ Arbitrary Client Deletion |
| CVE-2022-41619 | WordPress Image Zoom Plugin <= 1.8.8 is vulnerable to Broken Access Control |
| CVE-2022-41650 | WordPress Custom Content by Country plugin <= 3.1.2 - Broken Access Control vulnerability |
| CVE-2022-41656 | WordPress Account Manager for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability |
| CVE-2022-4169 | Theme and plugin translation for Polylang <= 3.2.16 - Missing Authorization |
| CVE-2022-41692 | WordPress Appointment Hour Booking plugin <= 1.3.71 - Missing Authorization vulnerability |
| CVE-2022-41695 | WordPress Traffic Manager Plugin <= 1.4.5 is vulnerable to Broken Access Control |
| CVE-2022-41698 | WordPress If Menu – Visibility control for Menus plugin <= 0.16.3 - Broken Access Control |
| CVE-2022-41786 | WordPress WP Job Portal Plugin <= 2.0.1 is vulnerable to Broken Access Control |
| CVE-2022-41790 | WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access Control |
| CVE-2022-41929 | Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore |
| CVE-2022-41930 | org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users |
| CVE-2022-41937 | Missing Authorization in XWiki Platform |
| CVE-2022-41995 | WordPress Photo Gallery – Image Gallery by Ape Plugin <= 2.2.8 is vulnerable to Broken Access Control |
| CVE-2022-42479 | WordPress Soledad premium theme <= 8.2.5 - Broken Access Control vulnerability |
| CVE-2022-42776 | In UscAIEngine service, there is a missing permission check. This could lead to set up UscAIEngine service with no additional... |
| CVE-2022-42777 | In power management service, there is a missing permission check. This could lead to set up power management service with no... |
| CVE-2022-42778 | In windows manager service, there is a missing permission check. This could lead to set up windows manager service with no ad... |
| CVE-2022-42884 | WordPress WIP Custom Login Plugin <= 1.2.7 is vulnerable to Broken Access Control |
| CVE-2022-43453 | WordPress WP Tools plugin <= 3.41 - Auth. Broken Access Control vulnerability |
| CVE-2022-43472 | WordPress eRoom plugin <= 1.4.6 - Broken Access Control vulnerability |
| CVE-2022-43476 | WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to Broken Access Control |
| CVE-2022-43482 | WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability |
| CVE-2022-4366 | Missing Authorization in lirantal/daloradius |
| CVE-2022-4384 | Stream < 3.9.2 - Subscriber+ Alert Creation |
| CVE-2022-4385 | Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update |
| CVE-2022-44422 | In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no... |
| CVE-2022-44423 | In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no... |
| CVE-2022-44424 | In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no... |
| CVE-2022-44434 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service wit... |
| CVE-2022-44435 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service wit... |
| CVE-2022-44436 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service wit... |
| CVE-2022-44437 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service wit... |
| CVE-2022-44438 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service wit... |
| CVE-2022-44439 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service wit... |
| CVE-2022-44578 | WordPress Owl Carousel plugin <= 0.5.3 - Broken Access Control vulnerability |
| CVE-2022-44626 | WordPress Squirrly SEO (Peaks) plugin <= 12.1.20 - Broken Access Control vulnerability |
| CVE-2022-44633 | WordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerabili... |
| CVE-2022-4501 | Mega Addons For WPBakery Page Builder <= 4.3.0 - Authenticated (Subscriber+) Settings Update |
| CVE-2022-45070 | WordPress Conditional Checkout Fields for WooCommerce plugin <= 1.2.3 - Broken Authentication vulnerability |
| CVE-2022-45349 | WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability |
| CVE-2022-45351 | WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability |
| CVE-2022-45352 | WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability |
| CVE-2022-45356 | WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability |
| CVE-2022-4555 | WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation |
| CVE-2022-45803 | WordPress Gutenberg Forms plugin <= 2.2.8.3 - Auth. Broken Access Control vulnerability |
| CVE-2022-45806 | WordPress Formidable Forms plugin <= 5.5.4 - Broken Access Control vulnerability |
| CVE-2022-45811 | WordPress Post Teaser plugin <= 4.1.5 - Auth. Broken Access Control vulnerability |
| CVE-2022-45813 | WordPress Advanced AJAX Product Filters plugin <= 1.6.3.3 - Broken Access Control + CSRF |
| CVE-2022-45819 | WordPress Popup Maker plugin <= 1.17.1 - Broken Access Control vulnerability |
| CVE-2022-45826 | WordPress Sunshine Photo Cart plugin <= 2.9.13 - Auth. Broken Access Control vulnerability |
| CVE-2022-45830 | WordPress Analytify - Google Analytics Dashboard plugin <= 4.2.3 - Privilege Escalation vulnerability |
| CVE-2022-45832 | WordPress Attorney theme <= 3 - Unauth. Arbitrary Content Deletion vulnerability |
| CVE-2022-45840 | WordPress Auto Affiliate Links plugin <= 6.2.1.5 - Unauth. Broken Access Control vulnerability |
| CVE-2022-45841 | WordPress Robo Gallery plugin <= 3.2.9 - Auth. Broken Access Control vulnerability |
| CVE-2022-45851 | WordPress ShareThis Dashboard for Google Analytics plugin <= 3.1.4 - Broken Access Control vulnerability |
| CVE-2022-46795 | WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 4.7.2 - CSRF Plugin Settings Reset vulnerability |
| CVE-2022-46796 | WordPress CURCY plugin <= 2.1.25 - Unauthenticated plugin settings change vulnerability |
| CVE-2022-46807 | WordPress Stock Sync for WooCommerce plugin <= 2.3.2 - Broken Access Control |
| CVE-2022-46811 | WordPress ALD Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 1.0.21 - Broken Access Control + CSRF |
| CVE-2022-46838 | WordPress JS Help Desk plugin <= 2.7.1 - Unauthenticated Settings Change Vulnerability |
| CVE-2022-46840 | WordPress JS Help Desk plugin <= 2.7.1 - Broken Access Control |
| CVE-2022-46845 | WordPress Slider a SlidersPack plugin <= 2.0.2 - Broken Access Control vulnerability |
| CVE-2022-46846 | WordPress Trending/Popular Post Slider and Widget plugin <= 1.5.7 - Broken Access Control vulnerability |
| CVE-2022-46850 | WordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File Deletion |
| CVE-2022-47168 | WordPress Printful Integration for WooCommerce plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) |
| CVE-2022-47176 | WordPress Depicter Slider plugin <= 1.9.0 - Broken Access Control vulnerability |
| CVE-2022-47182 | WordPress APIExperts Square for WooCommerce plugin <= 4.4.1 - Broken Access Control |
| CVE-2022-47425 | WordPress ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Bro... |
| CVE-2022-47429 | WordPress Coming Soon Landing Page and Maintenance Mode WordPress Plugin plugin <= 2.2.0 - Broken Access Control |
| CVE-2022-47594 | WordPress Essential Blocks for Gutenberg plugin <= 3.8.5 - Broken Access Control |
| CVE-2022-47601 | WordPress WP Table Manager plugin <= 3.5.2 - Broken Access Control |
| CVE-2022-47604 | WordPress AJAX Thumbnail Rebuild plugin <= 1.13 - Broken Access Control vulnerability |
| CVE-2022-48318 | Insecure access control mechanisms for RestAPI documentation |
| CVE-2022-4872 | WooCommerce Chained Products < 2.12.0 - Unauthenticated Arbitrary Options Update to 'no' |
| CVE-2022-4932 | Total Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure |
| CVE-2022-4939 | WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalation |
| CVE-2022-4940 | WCFM Membership <= 2.10.0 - Missing Authorization |
| CVE-2022-4943 | miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change |
| CVE-2022-4948 | FlyingPress <= 3.9.6 - Missing Authorization |
| CVE-2022-4950 | Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation |
| CVE-2022-4972 | Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export |
| CVE-2022-4974 | Freemius SDK <= 2.4.2 - Missing Authorization Checks |
| CVE-2023-0019 | In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_7... |
| CVE-2023-0291 | Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion |
| CVE-2023-0293 | Mediamatic – Media Library Folders <= 2.8.1 - Missing Authorization |
| CVE-2023-0335 | WP Shamsi <= 4.3.3 - Subscriber+ Attachment Deletion |
| CVE-2023-0336 | OoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment Deletion |
| CVE-2023-0402 | Social Warfare <= 4.3.0 - Missing Authorization |
| CVE-2023-0404 | Events Made Easy <= 2.3.16 - Missing Authorization |
| CVE-2023-0405 | GPT3 AI Content Writer < 1.4.38 - Subscriber+ Arbitrary Post Content Update |
| CVE-2023-0441 | Gallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options Update |
| CVE-2023-0447 | My YouTube Channel <= 3.0.12.1 - Missing Authorization |
| CVE-2023-0555 | Quick Restaurant Menu <= 2.0.2 - Missing Authorization |
| CVE-2023-0556 | ContentStudio <= 1.2.5 - Missing Authorization |
| CVE-2023-0619 | Kraken.io Image Optimizer <= 2.6.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update |
| CVE-2023-0678 | Missing Authorization in phpipam/phpipam |
| CVE-2023-0684 | Wicked Folders <= 2.18.16 - Missing Authorization via ajax_unassign_folders |
| CVE-2023-0711 | Wicked Folders <= 2.18.16 - Missing Authorization via ajax_save_state |
| CVE-2023-0712 | Wicked Folders <= 2.18.16 - Missing Authorization on ajax_move_object |
| CVE-2023-0713 | Wicked Folders <= 2.18.16 - Missing Authorization on ajax_add_folder |
| CVE-2023-0715 | Wicked Folders <= 2.18.16 - Missing Authorization on ajax_clone_folder |
| CVE-2023-0716 | Wicked Folders <= 2.18.16 - Missing Authorization on ajax_edit_folder |
| CVE-2023-0717 | Wicked Folders <= 2.18.16 - Missing Authorization via ajax_delete_folder |
| CVE-2023-0718 | Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder |
| CVE-2023-0719 | Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_order |
| CVE-2023-0720 | Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder_order |
| CVE-2023-0889 | TF Random Numbers < 2.0.1 - Subscriber+ Arbitrary Option Update |
| CVE-2023-0890 | Shortcodes Ultimate < 5.12.8 - Subscriber+ Arbitrary Post Access |
| CVE-2023-0911 | Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure |
| CVE-2023-0923 | Odh-notebook-controller-container: missing authorization allows for file contents disclosure |
| CVE-2023-0958 | Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function |
| CVE-2023-0993 | Shield Security <= 17.0.17 - Missing Authorization |
| CVE-2023-1022 | WP Meta SEO <= 4.5.3 - Missing Authorization in 'wpmsGGSaveInformation' |
| CVE-2023-1023 | WP Meta SEO <= 4.5.3 - Missing Authorization in 'saveSitemapSettings' |
| CVE-2023-1024 | WP Meta SEO <= 4.5.3 - Missing Authorization in 'regenerateSitemaps' |
| CVE-2023-1026 | WP Meta SEO <= 4.5.3 - Missing Authorization in 'listPostsCategory' |
| CVE-2023-1027 | WP Meta SEO <= 4.5.3 - Missing Authorization in 'checkAllCategoryInSitemap' |
| CVE-2023-1114 | Improper Input Validation on e-Belediye |
| CVE-2023-1169 | OoohBoi Steroids for Elementor <= 2.1.4 - Missing Authorization leading to Authenticated (Subscriber+) Image Upload |
| CVE-2023-1261 | Missing MAC layer security in Wi-SUN SDK |
| CVE-2023-1262 | Missing MAC layer security in Wi-SUN Linux Border Router |
| CVE-2023-1299 | Nomad Job Submitter Privilege Escalation Using Workload Identity |
| CVE-2023-1333 | RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_page_cache' |
| CVE-2023-1334 | RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'queue_posts' |
| CVE-2023-1335 | RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ucss_connect' |
| CVE-2023-1336 | RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ajax_deactivate' |
| CVE-2023-1337 | RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_uucss_logs' |
| CVE-2023-1338 | RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'attach_rule' |
| CVE-2023-1339 | RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'uucss_update_rule' |
| CVE-2023-1371 | W4 Post List < 2.4.6 - Subscriber+ Password Protected Post Content Disclosure |
| CVE-2023-1375 | WP Fastest Cache <= 1.1.2 - Missing Authorization to Cache Deletion |
| CVE-2023-1414 | WP VR < 8.3.0 - Subscriber+ Arbitrary Tour Update |
| CVE-2023-1705 | Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows P... |
| CVE-2023-1774 | Unauthorized email invite to a private channel |
| CVE-2023-1782 | Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation |
| CVE-2023-1843 | Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization |
| CVE-2023-1844 | Subscribe2 <= 10.40 - Missing Authorization |
| CVE-2023-1865 | YourChannel <= 1.2.3 - Missing Authorization to Plugin Settings Reset |
| CVE-2023-1868 | YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Reset |
| CVE-2023-1903 | Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0) |
| CVE-2023-1928 | WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_preload_single_callback' |
| CVE-2023-1929 | WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_purgecache_varnish_callback' |
| CVE-2023-1930 | WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_clear_cache_of_allsites_callback' |
| CVE-2023-1931 | WP Fastest Cache <= 1.1.2 - Missing Authorization in 'deleteCssAndJsCacheToolbar' |
| CVE-2023-2233 | Missing Authorization in GitLab |
| CVE-2023-22478 | KubePi is vulnerable to missing authorization |
| CVE-2023-22488 | Missing authorization in Flarum |
| CVE-2023-22489 | Flarum is missing authorization in discussion replies |
| CVE-2023-2261 | WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration |
| CVE-2023-23814 | WordPress Calendar Event Multi View plugin <= 1.4.13 - Broken Access Control vulnerability |
| CVE-2023-23823 | WordPress Enhanced Text Widget plugin <= 1.5.8 - Broken Access Control vulnerability |
| CVE-2023-23825 | WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Import_WPforms vulnerability |
| CVE-2023-23834 | WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Activate_Plugin vulnerabilit... |
| CVE-2023-23848 | Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission... |
| CVE-2023-23850 | A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permissio... |
| CVE-2023-23854 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perfo... |
| CVE-2023-23868 | WordPress Cost of Goods for WooCommerce plugin <= 2.8.6 - Broken Access Control vulnerability |
| CVE-2023-23882 | WordPress Ultimate Addons for Beaver Builder – Lite Plugin <= 1.5.5 is vulnerable to Broken Access Control |
| CVE-2023-23886 | WordPress WP-RecentComments plugin <= 2.2.7 - Broken Access Control vulnerability |
| CVE-2023-23887 | WordPress Easy Google Analytics for WordPress plugin <= 1.6.0 - Broken Access Control vulnerability |
| CVE-2023-23893 | WordPress Simple Giveaways plugin <= 2.48.0 - Broken Access Control vulnerability |
| CVE-2023-20064 | Cisco IOS XR Software Bootloader Unauthenticated Information Disclosure Vulnerability |
| CVE-2023-20252 | A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow a... |
| CVE-2023-2066 | Announcement & Notification Banner – Bulletin <= 3.6.0 - Missing Authorization Checks |
| CVE-2023-2078 | Buy Me a Coffee – Button and Widget Plugin <= 3.7 - Missing Authorization |
| CVE-2023-2083 | Essential Blocks <= 4.0.6 - Missing Authorization via save |
| CVE-2023-2084 | Essential Blocks <= 4.0.6 - Missing Authorization via get |
| CVE-2023-2085 | Essential Blocks <= 4.0.6 - Missing Authorization via templates |
| CVE-2023-2086 | Essential Blocks <= 4.0.6 - Missing Authorization via template_count |
| CVE-2023-2179 | WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update |
| CVE-2023-2189 | Elementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Missing Authorization in toggle_widget |
| CVE-2023-2193 | Oauth authorization codes do not expire when deauthorizing an oauth2 app |
| CVE-2023-2351 | WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via w... |
| CVE-2023-2353 | CHP Ads Block Detector <= 3.9.4 - Missing Authorization to Plugin Settings Update |
| CVE-2023-23611 | xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation |
| CVE-2023-23639 | WordPress MainWP Staging Extension Plugin <= 4.0.3 - Subscriber+ Arbitrary Plugin Activation Vulnerability |
| CVE-2023-23640 | WordPress MainWP UpdraftPlus Extension Plugin <= 4.0.6 - Subscriber+ Arbitrary Plugin Activation Vulnerability |
| CVE-2023-23672 | WordPress GiveWP plugin <= 2.25.1 - Arbitrary Content Deletion vulnerability |
| CVE-2023-23975 | WordPress Quick Event Manager plugin <= 9.7.4 - Broken Access Control vulnerability |
| CVE-2023-23985 | WordPress Quiz Maker plugin <= 6.3.9.4 - Content Spoofing |
| CVE-2023-23986 | WordPress Reviews and Rating – Google My Business plugin <= 4.14 - Broken Access Control vulnerability |
| CVE-2023-23988 | WordPress My Tickets plugin <= 1.9.11 - Payment Bypass Vulnerability |
| CVE-2023-2414 | Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary... |
| CVE-2023-2415 | Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout |
| CVE-2023-2494 | Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege Granting |
| CVE-2023-25026 | WordPress PayPal Brasil para WooCommerce plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2023-25030 | WordPress Buy Me a Coffee plugin <= 3.7 - Broken Access Control vulnerability |
| CVE-2023-25035 | WordPress Quick Contact Form plugin <= 8.0.3.1 - Broken Access Control vulnerability |
| CVE-2023-25037 | WordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerability |
| CVE-2023-25039 | WordPress Google Maps CP plugin <= 1.0.43 - Missing Authorization Leading To Feedback Submission Vulnerability |
| CVE-2023-25048 | WordPress Fantastic Content Protector Free plugin <= 2.6 - Broken Access Control vulnerability |
| CVE-2023-25060 | WordPress Album and Image Gallery plus Lightbox plugin <= 1.6.2 - Broken Access Control vulnerability |
| CVE-2023-25067 | WordPress We’re Open! plugin <= 1.45 - Broken Access Control vulnerability |
| CVE-2023-25068 | WordPress Magazine Edge theme <= 1.13 - Authenticated Arbitrary Plugin Activation |
| CVE-2023-2555 | WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Custom Drop-Down Currency Switcher Creati... |
| CVE-2023-25552 | A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deletin... |
| CVE-2023-2556 | WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switc... |
| CVE-2023-2557 | WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switc... |
| CVE-2023-25573 | Improper access control to download file in metersphere |
| CVE-2023-2561 | Gallery Metabox <= 1.5 - Missing Authorization via gallery_remove |
| CVE-2023-25791 | WordPress Fontiran plugin <= 2.1 - Broken Access Control vulnerability |
| CVE-2023-25799 | WordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilities |
| CVE-2023-2590 | Missing Authorization in answerdev/answer |
| CVE-2023-26520 | WordPress Advanced Text Widget plugin <= 2.1.2 - Broken Access Control vulnerability |
| CVE-2023-26521 | WordPress Search in Place plugin <= 1.0.104 - Missing Authorization Leading To Feedback Submission vulnerability |
| CVE-2023-26522 | WordPress WP Repost plugin <= 0.1 - Broken Access Control vulnerability |
| CVE-2023-26523 | WordPress Calculated Fields Form plugin <= 1.1.120 - Missing Authorization Leading To Feedback Submission Vulnerability |
| CVE-2023-2714 | Groundhogg <= 2.7.9.8 - Missing Authorization to Update License |
| CVE-2023-2715 | Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation |
| CVE-2023-2716 | Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload |
| CVE-2023-27263 | IDOR: Accessing playbook runs via the Playbooks Runs API |
| CVE-2023-27264 | IDOR: Updating a playbook via the Playbooks API |
| CVE-2023-27309 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected app... |
| CVE-2023-27310 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected app... |
| CVE-2023-28165 | WordPress Backup Bank: WordPress Backup Plugin plugin <= 4.0.28 - Broken Access Control vulnerability |
| CVE-2023-28168 | WordPress WordPress Console plugin <= 0.3.9 - Broken Access Control vulnerability |
| CVE-2023-28416 | WordPress Chankhe theme <= 1.0.5 - Authenticated Arbitrary Plugin Activation vulnerability |
| CVE-2023-28417 | WordPress Dynamics 365 Integration plugin <= 1.3.12 - Broken Access Control vulnerability |
| CVE-2023-28492 | WordPress Calendar Event Multi View plugin <= 1.4.10 - Missing Authorization Leading To Feedback Submission vulnerability |
| CVE-2023-28494 | WordPress Contact Form Email plugin <= 1.3.31 - Missing Authorization Leading To Feedback Submission Vulnerability |
| CVE-2023-28689 | WordPress JS Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2023-2869 | WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update |
| CVE-2023-28775 | WordPress Yoast SEO Premium plugin <= 20.4 - Unauthenticated Zapier API Key Reset vulnerability |
| CVE-2023-29237 | WordPress Remove Duplicate Posts plugin <= 1.3.5 - Broken Access Control vulnerability |
| CVE-2023-29239 | WordPress LuckyWP Scripts Control plugin <= 1.2.1 - Broken Access Control vulnerability |
| CVE-2023-29422 | WordPress Dynamics 365 Integration plugin <= 1.3.13 - Broken Access Control vulnerability |
| CVE-2023-29429 | WordPress User Registration plugin <= 2.3.2.1 - Broken Access Control vulnerability |
| CVE-2023-29431 | WordPress qTranslate X Cleanup and WPML Import plugin <= 3.0.1 - Broken Access Control vulnerability |
| CVE-2023-29433 | WordPress tencentcloud-cos plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2023-2945 | Missing Authorization in openemr/openemr |
| CVE-2023-31073 | WordPress Shortcode to display post and user data plugin <= 1.2.0 - Broken Access Control vulnerability |
| CVE-2023-31080 | WordPress Unlimited Elements For Elementor plugin <= 1.5.65 - Multiple Broken Access Control vulnerability |
| CVE-2023-31214 | WordPress WP Quick Post Duplicator plugin <= 2.0 - Broken Access Control vulnerability |
| CVE-2023-31234 | WordPress Tilda Publishing plugin <= 0.3.23 - Broken Access Control vulnerability |
| CVE-2023-3124 | Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option |
| CVE-2023-3125 | B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification |
| CVE-2023-3126 | B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Information Disclosure |
| CVE-2023-3131 | MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update |
| CVE-2023-3244 | Comments Like Dislike <= 1.2.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset |
| CVE-2023-32506 | WordPress Link Whisper Free plugin <= 0.6.3 - Unauthenticated Broken Access Control vulnerability |
| CVE-2023-32507 | WordPress Woo Custom Emails plugin <= 2.2 - Broken Access Control vulnerability |
| CVE-2023-32519 | WordPress WCP Contact Form plugin <= 3.1.0 - Broken Access Control vulnerability |
| CVE-2023-32520 | WordPress WCP Contact Form plugin <= 3.1.0 - Broken Access Control vulnerability |
| CVE-2023-32574 | WordPress Injection Guard plugin <= 1.2.1 - Broken Access Control vulnerability |
| CVE-2023-32959 | WordPress MetroStore theme <= 1.3.2 - Broken Access Control |
| CVE-2023-32963 | WordPress Predictive Search for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerability |
| CVE-2023-33321 | WordPress EventPrime plugin <= 2.8.6 - Sensitive Data Exposure |
| CVE-2023-33324 | WordPress Easy Captcha plugin <= 1.0 - Broken Access Control vulnerability |
| CVE-2023-3352 | Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletion |
| CVE-2023-3365 | MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion |
| CVE-2023-3403 | ProfileGrid <= 5.5.1 - Missing Authorization to User Import |
| CVE-2023-34186 | WordPress Headless CMS plugin <= 2.0.3 - Broken Authentication vulnerability |
| CVE-2023-3442 | Missing Authorization in Jenkins plug-in for ServiceNow DevOps |
| CVE-2023-34463 | Unauthorized users can delete applications in DataEase |
| CVE-2023-35037 | WordPress Surfer plugin <= 1.3.2.357 - Broken Access Control vulnerability |
| CVE-2023-35040 | WordPress SendPress Newsletters plugin <= 1.23.11.6 - Broken Access Control vulnerability |
| CVE-2023-35045 | WordPress Fat Rat Collect plugin <= 2.6.7 - Broken Access Control vulnerability |
| CVE-2023-35046 | WordPress Dynamic Visibility for Elementor plugin <= 5.0.5 - Broken Access Control vulnerability |
| CVE-2023-35049 | WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability |
| CVE-2023-35050 | WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability |
| CVE-2023-35051 | WordPress Contact Forms by Cimatti plugin <= 1.5.7 - Broken Access Control vulnerability |
| CVE-2023-35052 | WordPress Directorist plugin <= 7.5.4 - Arbitrary Content Deletion vulnerability |
| CVE-2023-35777 | WordPress The Events Calendar plugin <= 6.1.2.2 - Broken Access Control vulnerability |
| CVE-2023-3587 | Inconsistent state in UI after boards permission change by system admin |
| CVE-2023-35875 | WordPress Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.8.5 - Broken Access Control vulnerability |
| CVE-2023-35937 | Metersphere missing permission check |
| CVE-2023-35998 | ITM Server Missing Authorization in SOAP Endpoints |
| CVE-2023-36000 | ITM Server Missing Authorization for Agent Config |
| CVE-2023-36002 | ITM Server Missing Authorization for URL validation |
| CVE-2023-36504 | WordPress BBS e-Popup plugin <= 2.4.5 - Broken Access Control vulnerability |
| CVE-2023-36506 | WordPress YITH WooCommerce Waitlist plugin <= 2.13.0 - Broken Access Control vulnerability |
| CVE-2023-36509 | WordPress CHP Ads Block Detector plugin <= 3.9.5 - Broken Access Control vulnerability |
| CVE-2023-36510 | WordPress ReDi Restaurant Reservation plugin <= 23.0211 - Broken Access Control vulnerability |
| CVE-2023-36512 | WordPress AutomateWoo plugin <= 5.7.5 - Broken Access Control vulnerability |
| CVE-2023-36515 | WordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerability |
| CVE-2023-21450 | Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner's... |
| CVE-2023-22674 | WordPress Dashicons + Custom Post Types Plugin <= 1.0.2 is vulnerable to Broken Access Control |
| CVE-2023-22676 | WordPress Advanced Custom Fields: Image Crop Add-on Plugin <= 1.4.12 is vulnerable to Broken Access Control |
| CVE-2023-2268 | Plane v0.7.1 - Unauthorized access to files |
| CVE-2023-22697 | WordPress Survey Maker plugin <= 3.2.0 - Broken Access Control vulnerability |
| CVE-2023-22699 | WordPress MainWP Wordfence Extension Plugin <= 4.0.7 - Subscriber+ Arbitrary Plugin Activation Vulnerability |
| CVE-2023-22701 | WordPress Ebook Store plugin <= 5.775 - Broken Authentication vulnerability |
| CVE-2023-22708 | WordPress Kraken.io Image Optimizer plugin <= 2.6.7 - Broken Access Control vulnerability |
| CVE-2023-22728 | Silverstripe Framework has missing permission check of canView in GridFieldPrintButton |
| CVE-2023-22736 | argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled |
| CVE-2023-22737 | wire-server vulnerable to unauthorized removal of Bots from Conversations |
| CVE-2023-2275 | WooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Orde... |
| CVE-2023-2280 | WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit... |
| CVE-2023-22836 | In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the... |
| CVE-2023-2284 | WP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_db |
| CVE-2023-22858 | Stored cross-site scripting in BlogEngine.NET version 3.3.8.0 |
| CVE-2023-2299 | Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API |
| CVE-2023-2562 | Gallery Metabox <= 1.5 - Missing Authorization via refresh_metabox |
| CVE-2023-25703 | WordPress Meta slider and carousel with lightbox plugin <= 1.6.2 - Broken Access Control vulnerability |
| CVE-2023-25714 | WordPress Quick Paypal Payments plugin <= 5.7.25 - Broken Access Control vulnerability |
| CVE-2023-25715 | WordPress GamiPress Plugin <= 2.5.6 is vulnerable to Broken Access Control |
| CVE-2023-25785 | WordPress WP Post Rating plugin <= 2.5 - Vote Manipulation Vulnerability |
| CVE-2023-25959 | WordPress Apollo13 Framework Extensions plugin <= 1.8.10 - Broken Access Control |
| CVE-2023-25966 | WordPress FileBird plugin <= 5.1.4 - Broken Access Control vulnerability |
| CVE-2023-25969 | WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability |
| CVE-2023-25988 | WordPress Video Gallery – YouTube Gallery plugin <= 1.7.6 - Broken Access Control vulnerability |
| CVE-2023-25993 | WordPress Top 10 – Popular posts plugin for WordPress plugin <= 3.2.3 - Broken Access Control vulnerability |
| CVE-2023-25997 | WordPress Sola Support Ticket <= 3.17 - Arbitrary Content Deletion Vulnerability |
| CVE-2023-26002 | WordPress 6Storage Rentals <= 2.19.5 - Broken Access Control Vulnerability |
| CVE-2023-26035 | ZoneMinder vulnerable to Missing Authorization |
| CVE-2023-2796 | EventON < 2.1.2 - Unauthenticated Event Access |
| CVE-2023-28532 | WordPress Real Estate Directory theme <= 1.0.5 - Authenticated Arbitrary Plugin Activation |
| CVE-2023-28536 | WordPress Branded Social Images plugin <= 1.1.0 - Broken Access Control vulnerability |
| CVE-2023-28619 | WordPress Resoto theme <= 1.0.8 - Broken Access Control to Arbitrary Plugin Activation |
| CVE-2023-28623 | Unauthorized user can register an account in specific configurations in Zulip |
| CVE-2023-28990 | WordPress Viral Mag theme <= 1.0.9 - Authenticated Arbitrary Plugin Activation Vulnerability |
| CVE-2023-29173 | WordPress Product Category Tree plugin <= 2.5 - Broken Access Control vulnerability |
| CVE-2023-29174 | WordPress SKU Label Changer For WooCommerce plugin <= 3.0 - Broken Access Control vulnerability |
| CVE-2023-29529 | matrix-js-sdk vulnerable to invisible eavesdropping in group calls |
| CVE-2023-30476 | WordPress Blogger Buzz theme <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2023-30479 | WordPress Stamped.io Product Reviews & UGC for WooCommerce plugin <= 2.3.2 - Broken Access Control vulnerability |
| CVE-2023-30480 | WordPress Educenter theme <= 1.5.5 - Broken Access Control |
| CVE-2023-30486 | WordPress Square theme <= 2.0.0 - Broken Access Control |
| CVE-2023-30488 | WordPress Featured Post Creative plugin <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2023-30490 | WordPress Easing Slider plugin <= 3.0.8 - Plugin Settings Reset Vulnerability |
| CVE-2023-3053 | Page Builder by AZEXO <= 1.27.133 - Missing Authorization to Post Creation |
| CVE-2023-3204 | Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update |
| CVE-2023-32240 | WordPress Woodmart theme <= 7.2.1 - Broken Access Control vulnerability |
| CVE-2023-32293 | WordPress WRC Pricing Tables plugin <= 2.3.7 - Broken Access Control vulnerability |
| CVE-2023-32295 | WordPress Easy!Appointments plugin <= 1.3.3 - Arbitrary File Deletion vulnerability |
| CVE-2023-32299 | WordPress Ni WooCommerce Sales Report plugin <= 3.7.3 - Broken Access Control vulnerability |
| CVE-2023-3230 | Missing Authorization in fossbilling/fossbilling |
| CVE-2023-32311 | The CloudExplorer Lite missing permissions check |
| CVE-2023-32316 | Users can add themselves to any organization in CloudExplorer Lite |
| CVE-2023-33215 | WordPress Taggbox plugin <= 3.3 - Broken Access Control vulnerability |
| CVE-2023-33922 | WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability |
| CVE-2023-33923 | Broken Access Control leading to Arbitrary Plugin Activation in multiple HashThemes themes |
| CVE-2023-33928 | WordPress WordPress Backup & Migration plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2023-33948 | The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media f... |
| CVE-2023-33968 | Missing Access Control allows User to move and duplicate tasks in Kanboard |
| CVE-2023-33970 | Missing access control in internal task links feature in Kanboard |
| CVE-2023-33992 | Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA |
| CVE-2023-33994 | WordPress Slimstat Analytics plugin <= 5.0.5.1 - Broken Access Control vulnerability |
| CVE-2023-33995 | WordPress Photo Gallery by 10Web plugin <= 1.8.15 - Broken Access Control vulnerability |
| CVE-2023-33996 | WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.10 - Broken Access Control vulnerability |
| CVE-2023-33998 | WordPress Easy Social Icons plugin <= 3.2.5 - Broken Access Control vulnerability |
| CVE-2023-34003 | WordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerability |
| CVE-2023-34009 | WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.1 - Broken Access Control + CSRF |
| CVE-2023-34014 | WordPress Grid Plus plugin <= 1.3.2 - Broken Access Control vulnerability |
| CVE-2023-34019 | WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Broken Access Control vulnerability |
| CVE-2023-39438 | Missing Authorization check allows certain operations on CLA Assistant data |
| CVE-2023-40001 | WordPress iThemes Sync plugin <= 2.1.13 - Broken Access Control vulnerability |
| CVE-2023-40003 | WordPress WP Project Manager plugin <= 2.6.7 - Broken Access Control vulnerability |
| CVE-2023-40004 | Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress plugins |
| CVE-2023-40005 | WordPress Easy Digital Downloads plugin <= 3.1.5 - Broken Access Control |
| CVE-2023-40011 | WordPress Cost Calculator Builder plugin <= 3.1.42 - Broken Access Control vulnerability |
| CVE-2023-40027 | Conditionally missing authorization in @keystone-6/core |
| CVE-2023-40203 | WordPress MailChimp Forms by MailMunch plugin <= 3.1.4 - Broken Access Control |
| CVE-2023-40209 | WordPress Highcompress Image Compressor plugin <= 6.0.0 - Broken Access Control vulnerability |
| CVE-2023-40213 | WordPress Justified Gallery plugin <= 1.7.3 - Broken Access Control vulnerability |
| CVE-2023-4024 | Radio Player <= 2.0.73 - Missing Authorization to Player Deletion |
| CVE-2023-4025 | Radio Player <= 2.0.73 - Missing Authorization to Player Update |
| CVE-2023-4027 | Radio Player <= 2.0.73 - Missing Authorization to Settings Update |
| CVE-2023-40327 | WordPress Putler Connector for WooCommerce plugin <= 2.12.0 - Unauthenticated Broken Access Control vulnerability |
| CVE-2023-40331 | WordPress Accordion Slider plugin <= 1.9.6 - Broken Access Control vulnerability |
| CVE-2023-40334 | WordPress HUSKY plugin <= 1.3.4.2 - Broken Access Control vulnerability |
| CVE-2023-40376 | IBM UrbanCode Deploy (UCD) improper authentication controls |
| CVE-2023-40670 | WordPress ReviewX plugin <= 1.6.17 - Broken Access Control vulnerability |
| CVE-2023-40672 | WordPress Sticky Social Media Icons plugin <= 2.1 - Broken Access Control vulnerability |
| CVE-2023-40678 | WordPress Simple URLs plugin <= 117 - Broken Access Control vulnerability |
| CVE-2023-40679 | WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability |
| CVE-2023-41046 | Velocity execution without script rights in Xwiki platform |
| CVE-2023-4105 | Attachment of deleted message in a thread remains accessible and downloadable |
| CVE-2023-4106 | A guest user can perform various actions on public playbooks |
| CVE-2023-41130 | WordPress Premmerce User Roles plugin <= 1.0.12 - Broken Access Control vulnerability |
| CVE-2023-41132 | WordPress Category Slider for WooCommerce plugin <= 1.4.15 - Broken Access Control vulnerability |
| CVE-2023-4124 | Missing Authorization in answerdev/answer |
| CVE-2023-41240 | WordPress Pricing Deals for WooCommercePricing Deals for WooCommerce plugin <= 2.0.3.2 - Broken Access Control vulnerability |
| CVE-2023-41296 | Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect integri... |
| CVE-2023-41649 | WordPress Ovic Product Bundle plugin <= 1.1.2 - Broken Access Control vulnerability |
| CVE-2023-41651 | WordPress Multi-column Tag Map plugin <= 17.0.26 - Broken Access Control vulnerability |
| CVE-2023-41656 | WordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerability |
| CVE-2023-41664 | WordPress Easy Newsletter Signups plugin <= 1.0.4 - Broken Access Control vulnerability |
| CVE-2023-41671 | WordPress Abandoned Cart Lite for WooCommerce plugin <= 5.16.1 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2023-41683 | WordPress TelSender plugin <= 1.14.11 - Broken Access Control + CSRF vulnerability |
| CVE-2023-41688 | WordPress Bulk NoIndex & NoFollow Toolkit plugin <= 1.5 - Broken Access Control vulnerability |
| CVE-2023-41689 | WordPress Post to Google My Business (Google Business Profile) plugin <= 3.1.14 - Broken Access Control vulnerability |
| CVE-2023-41690 | WordPress WiserNotify Social Proof plugin <= 2.5 - Broken Access Control vulnerability |
| CVE-2023-41695 | WordPress Analytify plugin <= 5.1.0 - Broken Access Control vulnerability |
| CVE-2023-41750 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, mac... |
| CVE-2023-41802 | WordPress Super Socializer plugin <= 7.13.54 - Broken Access Control vulnerability |
| CVE-2023-41803 | WordPress BitPay Checkout for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability |
| CVE-2023-41805 | Broken Access Control vulnerability in multiple Brainstorm Force plugins |
| CVE-2023-41848 | WordPress Carousel Slider plugin <= 2.2.2 - Broken Access Control vulnerability |
| CVE-2023-41849 | WordPress Posts Like Dislike plugin <= 1.1.0 - Broken Access Control vulnerability |
| CVE-2023-41857 | WordPress Click To Tweet plugin <= 2.0.14 - Broken Access Control vulnerability |
| CVE-2023-41865 | WordPress Slider Pro plugin <= 4.8.6 - Broken Access Control vulnerability |
| CVE-2023-41866 | WordPress Automatic YouTube Gallery plugin <= 2.3.3 - Broken Access Control vulnerability |
| CVE-2023-41869 | WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.4 - Broken Access Control vulnerability |
| CVE-2023-41870 | WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerability |
| CVE-2023-41873 | WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability |
| CVE-2023-41875 | WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerability |
| CVE-2023-41951 | WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.6.14 - Broken Access Control vulnerability |
| CVE-2023-41952 | WordPress Fluent Forms plugin <= 5.0.8 - Broken Access Control vulnerability |
| CVE-2023-41953 | WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability |
| CVE-2023-4198 | Dolibarr ERP CRM (<= 17.0.3) Improper Access Control |
| CVE-2023-4245 | WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure |
| CVE-2023-42473 | Missing Authorization Check In S/4HANA (Manage Withholding Tax Items) |
| CVE-2023-4282 | EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and r... |
| CVE-2023-4302 | Missing permission checks in Fortify Plugin allow capturing credentials |
| CVE-2023-43652 | Non-MFA account takeover via using only SSH public key to login in jumpserver |
| CVE-2023-43700 | Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no n... |
| CVE-2023-4374 | WP Remote Users Sync <= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log View |
| CVE-2023-44142 | WordPress Inactive Logout plugin <= 3.2.2 - Broken Access Control vulnerability |
| CVE-2023-44147 | WordPress Comment Blacklist Updater plugin <= 1.1.0 - Broken Access Control vulnerability |
| CVE-2023-44148 | WordPress Astra Bulk Edit plugin <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2023-44149 | WordPress Brands for WooCommerce plugin <= 3.8.2.2 - Broken Access Control vulnerability |
| CVE-2023-44151 | WordPress Pre-Publish Checklist plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2023-44208 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis... |
| CVE-2023-44210 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis... |
| CVE-2023-44211 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis... |
| CVE-2023-44212 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis... |
| CVE-2023-44214 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, mac... |
| CVE-2023-44227 | WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File Deletion |
| CVE-2023-44234 | WordPress WP GPX Maps plugin <= 1.7.08 - Broken Access Control vulnerability |
| CVE-2023-44258 | WordPress Schema App Structured Data plugin <= 1.23.1 - Broken Access Control + CSRF vulnerability |
| CVE-2023-4434 | Missing Authorization in hamza417/inure |
| CVE-2023-44472 | WordPress Unyson plugin <= 2.7.28 - Broken Access Control vulnerability |
| CVE-2023-4468 | Poly Trio 8500/Trio 8800/Trio C60 Poly Lens Management Cloud Registration authorization |
| CVE-2023-4469 | Profile Extra Fields by BestWebSoft <= 1.2.7 - Missing Authorization to Sensitive Information Exposure |
| CVE-2023-44988 | WordPress WP Custom Admin Interface plugin <= 7.32 - Broken Access Control vulnerability |
| CVE-2023-45000 | WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability |
| CVE-2023-2174 | BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries |
| CVE-2023-23715 | WordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.2.2 - IDOR Leading To Job Removal Vulnerability |
| CVE-2023-23716 | WordPress Zendesk Support for WordPress plugin <= 1.8.4 - Broken Access Control vulnerability |
| CVE-2023-23725 | WordPress Shortcodes by Angie Makes plugin <= 3.46 - Broken Access Control vulnerability |
| CVE-2023-23729 | WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Contributor+ reCAPTCHA Settings Change Vulnerability |
| CVE-2023-2434 | Nested Pages <= 3.2.3 - Missing Authorization to Authenticated (Editor+) Plugin Settings Reset |
| CVE-2023-24375 | WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access Control v... |
| CVE-2023-24407 | WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability |
| CVE-2023-2448 | UserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template |
| CVE-2023-24524 | SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user... |
| CVE-2023-24528 | SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to expl... |
| CVE-2023-25445 | WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability |
| CVE-2023-25446 | WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability |
| CVE-2023-25454 | WordPress Protected Posts Logout Button plugin <= 1.4.5 - Broken Access Control vulnerability |
| CVE-2023-25455 | WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deleti... |
| CVE-2023-25457 | WordPress Slider Carousel – Responsive Image Slider plugin <=1.5.1 - Broken Access Control vulnerability |
| CVE-2023-25469 | WordPress Easy Table of Contents plugin <= 2.0.45.2 - Broken Access Control vulnerability |
| CVE-2023-25486 | WordPress Clone plugin <= 2.3.7 - Broken Access Control vulnerability |
| CVE-2023-26269 | Apache James server: Privilege escalation through unauthenticated JMX |
| CVE-2023-2627 | KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls |
| CVE-2023-27428 | WordPress WP users media plugin <= 4.2.3 - Broken Access Control vulnerability |
| CVE-2023-27437 | WordPress Event Espresso 4 Decaf plugin <= 4.10.44.decaf - Bypass vulnerability |
| CVE-2023-27449 | WordPress Total Poll Lite plugin <= 4.8.6 - Broken Access Control vulnerability |
| CVE-2023-27454 | WordPress Rife Elementor Extensions & Templates plugin <= 1.1.10 - Broken Access Control vulnerability |
| CVE-2023-27456 | WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation |
| CVE-2023-27460 | WordPress CP Contact Form with PayPal plugin <= 1.3.34 - Missing Authorization Leading To Feedback Submission vulnerability |
| CVE-2023-27462 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected app... |
| CVE-2023-2757 | Waiting: One-click countdowns <= 0.6.2 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Sit... |
| CVE-2023-27607 | WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerability |
| CVE-2023-27608 | WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Broken Access Control vulnerability |
| CVE-2023-27625 | WordPress Site Reviews plugin <= 6.5.0 - Broken Access Control vulnerability |
| CVE-2023-27626 | WordPress Stock Ticker plugin <= 3.23.0 - Broken Access Control vulnerability |
| CVE-2023-2764 | Draw Attention <= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modification |
| CVE-2023-2783 | App Framework does not checks for the secret provided in the incoming webhook request |
| CVE-2023-2784 | Apps Framework allows install requests from regular members via an internal path |
| CVE-2023-2786 | Channel commands execution doesn't properly verify permissions |
| CVE-2023-2787 | Collapsed Reply Threads APIs leak message contents from private channels |
| CVE-2023-2788 | Deactivated user can retain access using oauth2 api |
| CVE-2023-2791 | Playbooks lets you edit arbitrary posts |
| CVE-2023-3076 | MStore API < 3.9.9 - Unauthenticated Privilege Escalation |
| CVE-2023-30783 | WordPress Smart WooCommerce Search plugin <= 2.5.0 - Broken Access Control |
| CVE-2023-30870 | WordPress Sharkdropship for AliExpress Dropship and Affiliate plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilitie... |
| CVE-2023-30873 | WordPress WP Docs plugin <= 1.9.8 - Broken Access Control |
| CVE-2023-32094 | WordPress Extended Post Status plugin <= 1.0.19 - Broken Access Control vulnerability |
| CVE-2023-32112 | Missing Authorization Check in Vendor Master Hierarchy |
| CVE-2023-32117 | WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerability |
| CVE-2023-32126 | WordPress SALERT plugin <= 1.2.1 - Broken Access Control vulnerability |
| CVE-2023-32127 | WordPress Multi Rating plugin <= 5.0.6 - Unauth Arbitrary rating value change |
| CVE-2023-32129 | WordPress Editorialmag theme <= 1.1.9 - Authenticated Arbitrary Plugin Activation |
| CVE-2023-3213 | WP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_page |
| CVE-2023-32581 | WordPress WP-Chatbot for Messenger plugin <= 4.7 - Broken Access Control |
| CVE-2023-32585 | WordPress Portfolio Gallery – Responsive Image Gallery plugin <= 1.4.6 - Broken Access Control vulnerability |
| CVE-2023-32586 | WordPress SoundCloud Is Gold plugin <= 2.5.1 - Broken Access Control vulnerability |
| CVE-2023-32593 | WordPress GS Pins for Pinterest plugin <= 1.6.7 - Broken Access Control vulnerability |
| CVE-2023-32599 | WordPress reCAPTCHA for all plugin <= 1.22 - Broken Access Control vulnerability |
| CVE-2023-32601 | WordPress Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.12 - Broken Access Control vulnerability |
| CVE-2023-32677 | Users who can send invitations can erroneously add users to streams during invitation in Zulip |
| CVE-2023-32798 | WordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerability |
| CVE-2023-34234 | Governor proposal creation may be blocked by frontrunning in OpenZeppelin |
| CVE-2023-34376 | WordPress Change WooCommerce Add To Cart Button Text plugin <= 1.3 - Broken Access Control vulnerability |
| CVE-2023-34379 | WordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access Control |
| CVE-2023-34381 | WordPress Zippy plugin <= 1.6.2 - Broken Access Control vulnerability |
| CVE-2023-34387 | WordPress Constant Contact Forms plugin <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2023-35093 | WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control |
| CVE-2023-35164 | Unauthorized users can manipulate a dashboard created by an administrator in DataEase |
| CVE-2023-4627 | LadiApp <= 4.4 - Missing Authorization via save_config() |
| CVE-2023-4630 | Missing Authorization in GitLab |
| CVE-2023-46309 | WordPress wpDiscuz plugin <= 7.6.10 - Broken Access Control vulnerability |
| CVE-2023-4637 | WPvivid <= 0.9.94 - Missing Authorization |
| CVE-2023-4645 | Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajax |
| CVE-2023-46605 | WordPress Convertful – Your Ultimate On-Site Conversion Tool plugin <= 2.5 - Broken Access Control vulnerability |
| CVE-2023-46606 | WordPress AtomChat plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2023-46607 | WordPress WP iCal Availability plugin <= 1.0.3 - Broken Access Control vulnerability |
| CVE-2023-46608 | WordPress DoLogin Security plugin <= 3.7.1 - Multiple Broken Access Control vulnerability |
| CVE-2023-46609 | WordPress FeedFocal plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2023-46610 | WordPress Quill Forms plugin <= 3.3.0 - Broken Access Control + CSRF vulnerability |
| CVE-2023-46612 | WordPress Mediabay plugin <= 1.6 - Broken Access Control vulnerability |
| CVE-2023-46616 | WordPress Draw Attention plugin <= 2.0.15 - Broken Access Control vulnerability |
| CVE-2023-46628 | WordPress WP Word Count plugin <= 3.2.4 - Broken Access Control vulnerability |
| CVE-2023-36516 | WordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerability |
| CVE-2023-36518 | WordPress Post Hit Counter plugin <= 1.3.2 - Broken Access Control |
| CVE-2023-36519 | WordPress SW Product Bundles plugin <= 2.0.15 - Broken Access Control vulnerability |
| CVE-2023-36526 | WordPress Duplicate Post Page Menu & Custom Post Type plugin <= 2.4.1 - Broken Access Control vulnerability |
| CVE-2023-36528 | WordPress kk Star Ratings plugin <= 5.4.3 - Rate Manipulation due to IP Spoofing Vulnerability |
| CVE-2023-36531 | WordPress LiquidPoll plugin <= 3.3.68 - Broken Access Control vulnerability |
| CVE-2023-36607 | CVE-2023-36607 |
| CVE-2023-36676 | WordPress Spectra plugin <= 2.6.6 - Broken Access Control vulnerability |
| CVE-2023-36680 | WordPress Image Regenerate & Select Crop plugin <= 7.1.0 - Broken Access Control vulnerability |
| CVE-2023-36681 | WordPress Cryptocurrency Widgets – Price Ticker & Coins List plugin <= 2.6.2 - Broken Access Control vulnerability |
| CVE-2023-36683 | WordPress Schema Pro plugin <= 2.7.8 - Broken Access Control vulnerability |
| CVE-2023-36684 | WordPress Convert Pro plugin <= 1.7.5 - Broken Access Control vulnerability |
| CVE-2023-36694 | WordPress Kingkong Board plugin <= 2.1.0.2 - Broken Access Control vulnerability |
| CVE-2023-36695 | WordPress Sublanguage plugin <= 2.9 - Broken Access Control vulnerability |
| CVE-2023-36815 | Sealos billing system permission control defect |
| CVE-2023-3713 | ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update |
| CVE-2023-3714 | ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation |
| CVE-2023-37394 | WordPress WP Dummy Content Generator plugin <= 2.3.0 - Broken Access Control vulnerability |
| CVE-2023-37860 | PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panels |
| CVE-2023-37862 | PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panels |
| CVE-2023-37869 | WordPress Premium Addons PRO plugin <= 2.9.0 - Broken Access Control vulnerability |
| CVE-2023-37870 | WordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerability |
| CVE-2023-37872 | WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.5 - Broken Access Control vulnerability |
| CVE-2023-37885 | WordPress RealHomes theme <= 4.0.2 - Broken Access Control vulnerability |
| CVE-2023-37886 | WordPress RealHomes theme <= 4.0.2 - Broken Access Control vulnerability |
| CVE-2023-37887 | WordPress WPSchoolPress plugin <= 2.2.7 - Broken Access Control vulnerability |
| CVE-2023-37890 | WordPress KB Support Plugin <= 1.5.88 is vulnerable to Broken Access Control |
| CVE-2023-37910 | org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move |
| CVE-2023-37967 | WordPress DirectoryPress plugin <= 3.6.2 - Unauthenticated Broken Access Control Vulnerability |
| CVE-2023-37969 | WordPress Checkout with Zelle on Woocommerce plugin <= 3.1 - Broken Access Control vulnerability |
| CVE-2023-37971 | WordPress WooCommerce Product Stock Alert plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2023-37984 | WordPress Quiz And Survey Master plugin <= 8.1.10 - Broken Access Control vulnerability |
| CVE-2023-37987 | WordPress YourMembership Single Sign On plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2023-37989 | WordPress Easyship WooCommerce Shipping Rates plugin <= 0.9.0 - Broken Access Control vulnerability |
| CVE-2023-38102 | NETGEAR ProSAFE Network Management System createUser Missing Authorization Privilege Escalation Vulnerability |
| CVE-2023-38383 | WordPress Language plugin <= 1.2.1 - Broken Access Control vulnerability |
| CVE-2023-38385 | WordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerability |
| CVE-2023-38386 | WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability |
| CVE-2023-38393 | WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability |
| CVE-2023-38394 | WordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerability |
| CVE-2023-38395 | WordPress WP Clone Menu plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2023-38475 | WordPress Donations Made Easy – Smart Donations plugin <= 4.0.12 - Broken Access Control vulnerability |
| CVE-2023-38477 | WordPress QR code MeCard/vCard generator plugin <= 1.6.0 - Broken Access Control vulnerability |
| CVE-2023-38479 | WordPress Simple Googlebot Visit plugin <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2023-38480 | WordPress Booster Elementor Addons plugin <= 1.4.9 - Broken Access Control vulnerability |
| CVE-2023-38483 | WordPress Instant CSS plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2023-38508 | Tuleap allows preview of a linked artifact with a type does not respect permissions |
| CVE-2023-38510 | Tolgee Lacks Permission Check for API Key for some endpoints |
| CVE-2023-38514 | WordPress Social Share Icons & Social Share Buttons plugin <= 3.5.7 - Broken Access Control vulnerability |
| CVE-2023-39167 | SENEC: Storage Box V1,V2 and V3 affected by improper access control vulnerability |
| CVE-2023-39298 | QTS, QuTS hero |
| CVE-2023-39305 | WordPress Yet Another Stars Rating plugin <= 3.4.3 - Broken Access Control vulnerability |
| CVE-2023-39310 | WordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerability |
| CVE-2023-39312 | WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability |
| CVE-2023-39544 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSC... |
| CVE-2023-3956 | InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setti... |
| CVE-2023-39920 | WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability |
| CVE-2023-39922 | WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerability |
| CVE-2023-39966 | 1Panel arbitrary file write vulnerability exists in the background |
| CVE-2023-3999 | Waiting: One-click countdowns <= 0.6.2 - Missing Authorization |
| CVE-2023-39990 | WordPress Paid Memberships Pro plugin <= 1.2.3 - Broken Access Control vulnerability |
| CVE-2023-39993 | WordPress ElementsKit Lite plugin <= 2.9.0 - Broken Access Control vulnerability |
| CVE-2023-39994 | WordPress ARMember Premium plugin <= 5.9.2 - Broken Access Control |
| CVE-2023-39995 | WordPress Portfolio and Projects plugin <= 1.3.7 - Broken Access Control vulnerability |
| CVE-2023-39996 | WordPress Accordion and Accordion Slider plugin <= 1.2.4 - Broken Access Control |
| CVE-2023-39997 | WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control Vulnerability |
| CVE-2023-39998 | WordPress BeTheme theme <= 27.1.1 - Author+ Broken Access Control vulnerability |
| CVE-2023-4059 | Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation |
| CVE-2023-40603 | WordPress Simple Org Chart plugin <= 2.3.4 - Broken Access Control vulnerability |
| CVE-2023-40608 | WordPress Paid Memberships Pro CCBill Gateway plugin <= 0.3 - Unauthenticated Broken Access Control vulnerability |
| CVE-2023-40625 | Missing Authorization check in SAP Manage Purchase Contracts App |
| CVE-2023-49154 | WordPress Button Generator – easily Button Builder plugin <= 2.3.8 - Broken Access Control vulnerability |
| CVE-2023-49156 | WordPress GoDaddy Email Marketing plugin <= 1.4.3 - Broken Access Control vulnerability |
| CVE-2023-49167 | WordPress Database for CF7 plugin <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2023-49192 | WordPress Enhanced Text Widget plugin <= 1.6.3 - Broken Access Control vulnerability |
| CVE-2023-49193 | WordPress Grow Social plugin <= 1.30.0 - Broken Access Control vulnerability |
| CVE-2023-49196 | WordPress Pagelayer plugin <= 1.7.7 - Broken Access Control vulnerability |
| CVE-2023-49754 | WordPress Bulk Edit Post Titles plugin <= 5.0.0 - Broken Access Control vulnerability |
| CVE-2023-49755 | WordPress Elementor Timeline Widget plugin <= 2.2 - Notice Dismissal Vulnerability |
| CVE-2023-49756 | WordPress Eventin plugin <= 3.3.52 - Authenticated Notice Dismissal Vulnerability |
| CVE-2023-49757 | WordPress Awesome Support plugin <= 6.1.10 - Broken Access Control + CSRF vulnerability |
| CVE-2023-49758 | WordPress WP Booking System plugin <= 2.0.19.2 - Broken Access Control vulnerability |
| CVE-2023-49817 | WordPress Flexible Woocommerce Checkout Field Editor plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2023-49818 | WordPress Webflow Pages plugin <= 1.0.8 - Broken Access Control vulnerability |
| CVE-2023-49831 | WordPress RegistrationMagic plugin <= 5.2.3.0 - Broken Access Control vulnerability |
| CVE-2023-49832 | WordPress Site Reviews plugin <= 6.10.2 - Broken Access Control vulnerability |
| CVE-2023-49835 | WordPress Post Duplicator plugin <= 2.31 - Broken Access Control vulnerability |
| CVE-2023-49845 | WordPress Redirects plugin <= 1.2.1 - Broken Access Control vulnerability |
| CVE-2023-49848 | WordPress Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy plugin <= 2.1.1 - Broken Access Control vulnerability |
| CVE-2023-49849 | WordPress Shortcoder plugin <= 6.3 - Broken Access Control vulnerability |
| CVE-2023-49850 | WordPress WP Simple HTML Sitemap plugin <= 2.7 - Broken Access Control vulnerability |
| CVE-2023-49851 | WordPress Square Thumbnails plugin <= 1.1.1 - Broken Access Control + CSRF vulnerability |
| CVE-2023-49856 | WordPress Smart Forms plugin <= 2.6.84 - Authenticated Arbitrary Options Change Vulnerability |
| CVE-2023-49857 | WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability |
| CVE-2023-49858 | WordPress Custom Login plugin <= 4.1.0 - Broken Access Control vulnerability |
| CVE-2023-49859 | WordPress Login With Ajax plugin <= 4.1 - Broken Access Control vulnerability |
| CVE-2023-49861 | WordPress Social Media Feather plugin <= 2.1.3 - Broken Access Control vulnerability |
| CVE-2023-51375 | WordPress EmbedPress plugin <= 3.8.3 - Broken Access Control vulnerability |
| CVE-2023-51376 | WordPress ProjectHuddle Client Site plugin <= 1.0.34 - Broken Access Control vulnerability |
| CVE-2023-51377 | WordPress Everest Forms plugin <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2023-51413 | WordPress Piotnet Forms plugin <= 1.0.29 - Broken Access Control vulnerability |
| CVE-2023-45002 | WordPress WP User Frontend plugin <= 3.6.8 - Broken Access Control vulnerability |
| CVE-2023-45045 | WordPress WP Custom Widget area plugin <= 1.2.5 - Broken Access Control vulnerability |
| CVE-2023-45061 | WordPress WP Job Openings plugin <= 3.4.1 - Broken Access Control vulnerability |
| CVE-2023-45101 | WordPress Customer Reviews for WooCommerce plugin <= 5.36.0 - Broken Access Control vulnerability |
| CVE-2023-45104 | WordPress BetterLinks plugin <= 1.6.0 - Broken Access Control vulnerability |
| CVE-2023-45110 | WordPress Bold Timeline Lite plugin <= 1.1.9 - Broken Access Control vulnerability |
| CVE-2023-45240 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, mac... |
| CVE-2023-45242 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Clo... |
| CVE-2023-45243 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Clo... |
| CVE-2023-45244 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis... |
| CVE-2023-45245 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, mac... |
| CVE-2023-45246 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis... |
| CVE-2023-45247 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis... |
| CVE-2023-45271 | WordPress ProductX – Gutenberg WooCommerce Blocks plugin <= 2.7.8 - Broken Access Control vulnerability |
| CVE-2023-45272 | WordPress 10Web Map Builder for Google Maps plugin <= 1.0.73 - Notice Dismissal Vulnerability |
| CVE-2023-45275 | WordPress Contact Form builder with drag & drop plugin <= 2.3.28 - Broken Access Control vulnerability |
| CVE-2023-45631 | WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2023-45633 | WordPress IMPress Listings plugin <= 2.6.2 - Broken Access Control vulnerability |
| CVE-2023-45636 | WordPress Backup & Migration plugin <= 1.4.1 - Broken Access Control vulnerability |
| CVE-2023-45649 | WordPress Appointment Hour Booking plugin <= 1.4.23 - Broken Access Control vulnerability |
| CVE-2023-45658 | WordPress Nexter theme <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2023-45760 | WordPress wpDiscuz plugin <= 7.6.3 - Broken Access Control vulnerability |
| CVE-2023-45765 | WordPress WP ERP plugin <= 1.12.6 - Broken Access Control vulnerability |
| CVE-2023-45766 | WordPress Poll Maker plugin <= 4.7.1 - Broken Access Control vulnerability |
| CVE-2023-45828 | WordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerability |
| CVE-2023-4606 | An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. ... |
| CVE-2023-46073 | WordPress DX Delete Attached Media plugin <= 2.0.5.1 - Broken Access Control vulnerability + CSRF |
| CVE-2023-46079 | WordPress Ashe Extra plugin <= 1.2.9 - Broken Access Control + CSRF vulnerability |
| CVE-2023-46080 | WordPress ApplyOnline – Application Form Builder and Manager plugin <= 2.5.3 - Broken Access Control vulnerability |
| CVE-2023-46082 | WordPress Broken Link Checker | Finder plugin <= 2.4.2 - Broken Access Control vulnerability |
| CVE-2023-46083 | WordPress Kali Forms plugin <= 2.3.27 - Broken Access Control vulnerability |
| CVE-2023-46146 | WordPress Themify Ultra theme <= 7.3.5 - Multiple Broken Access Control vulnerability |
| CVE-2023-46148 | WordPress Themify Ultra theme <= 7.3.5 - Authenticated Arbitrary Settings Change vulnerability |
| CVE-2023-46188 | WordPress Freesoul Deactivate Plugins plugin <= 2.1.3 - Broken Access Control vulnerability |
| CVE-2023-46195 | WordPress Headline Analyzer plugin <= 1.3.1 - Broken Access Control vulnerability |
| CVE-2023-46196 | WordPress Social proof testimonials and reviews by Repuso plugin <= 4.97 - Broken Access Control vulnerability |
| CVE-2023-46203 | WordPress Just Custom Fields plugin <= 3.3.2 - Broken Access Control vulnerability |
| CVE-2023-46206 | WordPress MW WP Form plugin <= 4.4.5 - Broken Access Control vulnerability |
| CVE-2023-46212 | WordPress WP EXtra Plugin <= 6.2 is vulnerable to Broken Access Control |
| CVE-2023-4686 | WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure |
| CVE-2023-4700 | Missing Authorization in GitLab |
| CVE-2023-47112 | Authenticated users can view job names and groups they do not have authorization to view in Rundeck |
| CVE-2023-47148 | IBM Storage Protect Plus Server information disclosure |
| CVE-2023-47179 | WordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerability |
| CVE-2023-47180 | WordPress Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin <= 2.16.0 - Arbitrary Content Deletion vulner... |
| CVE-2023-47183 | WordPress GiveWP plugin <= 2.33.1 - Broken Access Control vulnerability |
| CVE-2023-47187 | WordPress Animated Rotating Words plugin <= 5.4 - Broken Access Control vulnerability |
| CVE-2023-47188 | WordPress Simple Job Board plugin <= 2.10.5 - Broken Access Control vulnerability |
| CVE-2023-47224 | WordPress WP Travel plugin <= 7.8.0 - Broken Access Control vulnerability |
| CVE-2023-47225 | WordPress Short URL plugin <= 1.6.8 - Broken Access Control vulnerability |
| CVE-2023-4723 | Elementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information Exposure |
| CVE-2023-47241 | WordPress CoCart – Headless ecommerce plugin <= 3.11.2 - Broken Access Control vulnerability |
| CVE-2023-4728 | LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.4 - Missing Authorization on publish_lp() |
| CVE-2023-4730 | LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.3 - Missing Authorization via init_endpoint |
| CVE-2023-47515 | WordPress Seers | GDPR & CCPA Cookie Consent & Compliance plugin <= 8.1.1 - Broken Access Control vulnerability |
| CVE-2023-47681 | WordPress WooCommerce Checkout Manager plugin <= 7.3.0 - Broken Access Control vulnerability |
| CVE-2023-47689 | WordPress Animator plugin <= 3.0.10 - Unauthenticated Plugin Settings Change Vulnerability |
| CVE-2023-47692 | WordPress Flo Forms plugin <= 1.0.41 - Broken Access Control vulnerability |
| CVE-2023-47693 | WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerability |
| CVE-2023-47694 | WordPress Mini Cart Drawer For WooCommerce plugin <= 4.0.0 - Broken Access Control vulnerability |
| CVE-2023-47698 | WordPress Japanized For WooCommerce plugin <= 2.6.4 - Multiple Broken Access Control vulnerability |
| CVE-2023-47754 | WordPress Delete Duplicate Posts Plugin <= 4.8.9 is vulnerable to Broken Access Control |
| CVE-2023-47756 | WordPress Welcome Email Editor plugin <= 5.0.6 - Broken Access Control vulnerability |
| CVE-2023-47757 | WordPress AWeber Plugin <= 7.3.9 is vulnerable to Broken Access Control |
| CVE-2023-47760 | WordPress Essential Blocks plugin <= 4.2.0 - Broken Access Control vulnerability |
| CVE-2023-47761 | WordPress Simple 301 Redirects by BetterLinks plugin <= 2.0.7 - Broken Access Control vulnerability |
| CVE-2023-47762 | WordPress BetterDocs plugin <= 2.5.2 - Broken Access Control vulnerability |
| CVE-2023-47763 | WordPress WP Custom Admin Interface plugin <= 7.31 - Broken Access Control vulnerability |
| CVE-2023-47764 | WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerability |
| CVE-2023-47770 | WordPress BeTheme theme <= 27.1.1 - Contributor+ Broken Access Control vulnerability |
| CVE-2023-47771 | WordPress Essential Grid plugin <= 3.0.18 - Multiple Authenticated Broken Access Control vulnerability |
| CVE-2023-47776 | WordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerability |
| CVE-2023-47778 | WordPress LuckyWP Scripts Control plugin <= 1.2.1 - Broken Access Control vulnerability |
| CVE-2023-47780 | WordPress EasyAzon – Amazon Associates Affiliate Plugin plugin <= 5.1.0 - Broken Access Control vulnerability |
| CVE-2023-47783 | WordPress Thrive Theme Builder theme < 3.24.0 - Multiple Authenticated Broken Access Control vulnerability |
| CVE-2023-47788 | WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability |
| CVE-2023-47793 | WordPress Acme Fix Images plugin <= 1.0.0 - Broken Access Control vulnerability |
| CVE-2023-47805 | WordPress WPCafe plugin <= 2.2.22 - Broken Access Control vulnerability |
| CVE-2023-47807 | WordPress 10WebAnalytics plugin <= 1.2.12 - Broken Access Control vulnerability |
| CVE-2023-47820 | WordPress WP Like Button plugin <= 1.7.0 - Broken Access Control vulnerability |
| CVE-2023-47822 | WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10 - Broken Access Control vulnerability |
| CVE-2023-47823 | WordPress FormCraft – Contact Form Builder for WordPress plugin <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2023-47826 | WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2023-47828 | WordPress wpMandrill plugin <= 1.33 - Broken Access Control vulnerability |
| CVE-2023-47830 | WordPress Live Preview for Contact Form 7 plugin <= 1.2.0 - Broken Access Control vulnerability |
| CVE-2023-47832 | WordPress SearchIQ plugin <= 4.4 - Broken Access Control vulnerability |
| CVE-2023-47836 | WordPress WP Meta and Date Remover plugin <= 2.3.0 - Broken Access Control vulnerability |
| CVE-2023-47838 | WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.1 - Broken Access Control vulnerability |
| CVE-2023-47841 | WordPress Analytify plugin <= 5.1.1 - Broken Access Control vulnerability |
| CVE-2023-47847 | WordPress PayTR Taksit Tablosu plugin <= 1.3.1 - Broken Access Control vulnerability |
| CVE-2023-47849 | WordPress BlossomThemes Email Newsletter plugin <= 2.2.4 - Broken Access Control vulnerability |
| CVE-2023-47870 | WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF) |
| CVE-2023-47871 | WordPress Contact Form to Any API plugin <= 1.1.6 - Broken Access Control vulnerability |
| CVE-2023-47874 | WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Broken Access Control |
| CVE-2023-4792 | Duplicate Post Page Menu & Custom Post Type <= 2.3.1 - Missing Authorization to Post Duplication |
| CVE-2023-5331 | File Information Leak via IDOR in file_id in Draft Posts |
| CVE-2023-53740 | Screen SFT DAB 1.9.3 Authentication Bypass via Admin Password Change |
| CVE-2023-5385 | Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication |
| CVE-2023-5386 | Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion |
| CVE-2023-5387 | Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode |
| CVE-2023-53923 | UliCMS 2023.1 Privilege Escalation via Unauthenticated Admin Account Creation |
| CVE-2023-5411 | Funnelforms Free <= 3.4 - Missing Authorization to Post Modification |
| CVE-2023-5415 | Funnelforms Free <= 3.4 - Missing Authorization to New Category Creation |
| CVE-2023-5525 | Limit Login Attempts Reloaded < 2.25.26 - Admin+ Missing Authorization to Toggle Plugin Auto-Update |
| CVE-2023-5533 | AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions |
| CVE-2023-5559 | 10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion |
| CVE-2023-5600 | Missing Authorization in GitLab |
| CVE-2023-5611 | Seraphinite Accelerator < 2.20.32 - Unauthorised Settings Reset/Import |
| CVE-2023-5612 | Missing Authorization in GitLab |
| CVE-2023-5651 | WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion |
| CVE-2023-46631 | WordPress Product Recommendation Quiz for eCommerce plugin <= 2.1.2 - Broken Access Control vulnerability |
| CVE-2023-46632 | WordPress My Shortcodes plugin <= 2.3 - Broken Access Control vulnerability |
| CVE-2023-46633 | WordPress WP Glossary plugin <= 3.1.2 - Broken Access Control vulnerability |
| CVE-2023-46635 | WordPress YITH WooCommerce Product Add-Ons plugin <= 4.2.0 - Broken Access Control vulnerability |
| CVE-2023-46637 | WordPress Generate Dummy Posts plugin <= 1.0.0 - Broken Access Control vulnerability |
| CVE-2023-46639 | WordPress kk Star Ratings plugin <= 5.4.5 - Broken Access Control vulnerability |
| CVE-2023-46644 | WordPress WordPress CTA plugin <= 1.5.8 - Broken Access Control vulnerability |
| CVE-2023-4668 | Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe |
| CVE-2023-47523 | WordPress Auto Tag Creator plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2023-47557 | WordPress Visitor Traffic Real Time Statistics plugin <= 7.2 - Broken Access Control vulnerability |
| CVE-2023-47647 | WordPress BadgeOS plugin <= 3.7.1.6 - Broken Access Control vulnerability |
| CVE-2023-47648 | WordPress EazyDocs plugin <= 2.3.5 - Broken Access Control vulnerability |
| CVE-2023-47661 | WordPress Dragfy Addons for Elementor plugin <= 1.0.2 - Broken Access Control + CSRF vulnerability |
| CVE-2023-48222 | Authenticated users can view or delete jobs they do not have authorization for in Rundeck |
| CVE-2023-48273 | WordPress Preloader for Website plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerability |
| CVE-2023-48274 | WordPress WCMultiShipping plugin <= 2.3.5 - Broken Access Control vulnerability |
| CVE-2023-48277 | WordPress Super Progressive Web Apps plugin <= 2.2.21 - Broken Access Control vulnerability |
| CVE-2023-48280 | WordPress Consensu.io plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2023-48286 | WordPress Accept Stripe Payments plugin <= 2.0.79 - Broken Access Control vulnerability |
| CVE-2023-48287 | WordPress TextMe SMS plugin <= 1.9.0 - Broken Access Control vulnerability |
| CVE-2023-48324 | WordPress Awesome Support HelpDesk plugin <= 6.1.4 - Broken Access control vulnerability |
| CVE-2023-48332 | WordPress Mail Bank – #1 Mail SMTP Plugin for WordPress plugin <= 4.0.14 - Broken Access Control vulnerability |
| CVE-2023-48375 | SmartStar Software CWS Web-Base - Broken Access Control |
| CVE-2023-48676 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis... |
| CVE-2023-48683 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis... |
| CVE-2023-48684 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis... |
| CVE-2023-48739 | WordPress Porto Theme Functionality plugin < 2.12.1 - Broken Access Control vulnerability |
| CVE-2023-48740 | WordPress Easy Social Feed plugin <= 6.5.1 - Broken Access Control vulnerability |
| CVE-2023-48750 | WordPress Void Elementor Post Grid Addon for Elementor Page builder plugin <= 2.1.10 - Broken Access Control vulnerability |
| CVE-2023-48751 | WordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control |
| CVE-2023-48758 | WordPress JetEngine plugin <= 3.2.4 - Broken Access Control vulnerability |
| CVE-2023-48759 | WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerability |
| CVE-2023-48760 | WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerability |
| CVE-2023-48761 | WordPress JetElements For Elementor plugin <= 2.6.13 - Broken Access Control vulnerability |
| CVE-2023-48774 | WordPress IdeaPush plugin < 8.58 - Broken Access Control vulnerability |
| CVE-2023-48775 | WordPress WP CleanFix plugin <= 5.6.2 - Broken Access Control vulnerability |
| CVE-2023-48776 | WordPress canvasio3D Light plugin <= 2.5.0 - Broken Access Control vulnerability |
| CVE-2023-48779 | WordPress 360 Javascript Viewer plugin <= 1.7.11 - Broken Access Control vulnerability |
| CVE-2023-4895 | Missing Authorization in GitLab |
| CVE-2023-4938 | BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation |
| CVE-2023-4941 | BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation |
| CVE-2023-4943 | BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation |
| CVE-2023-4947 | WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update |
| CVE-2023-4948 | WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update |
| CVE-2023-49620 | Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for |
| CVE-2023-49742 | WordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerability |
| CVE-2023-50373 | WordPress Alt Manager plugin <= 1.6.1 - Broken Access Control vulnerability |
| CVE-2023-50375 | WordPress Translate WordPress – Google Language Translator plugin <= 6.0.19 - Broken Access Control vulnerability |
| CVE-2023-5054 | Super Store Finder <= 6.9.3 - Unauthenticated Email Creation/Sending |
| CVE-2023-5056 | Skupper-operator: privelege escalation via config map |
| CVE-2023-5061 | Missing Authorization in GitLab |
| CVE-2023-50850 | WordPress Woo Subscriptions plugin < 5.8.0 - Broken Access Control vulnerability |
| CVE-2023-50876 | WordPress Molongui plugin <= 4.7.3 - Broken Access Control vulnerability |
| CVE-2023-50877 | WordPress Product Filter by WBW plugin <= 2.5.0 - Broken Access Control vulnerability |
| CVE-2023-50882 | WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability |
| CVE-2023-50884 | WordPress LA-Studio Element Kit for Elementor plugin <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2023-50887 | WordPress User Feedback plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2023-50898 | WordPress Image Optimizer, Resizer and CDN – Sirv plugin <= 7.1.2 - Broken Access Control vulnerability |
| CVE-2023-50899 | WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 5.0.2 - Broken Access Control vulnerability |
| CVE-2023-50903 | WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerability |
| CVE-2023-50904 | WordPress Poll Maker plugin <= 4.8.0 - Broken Access Control vulnerability |
| CVE-2023-50944 | Apache Airflow: Bypass permission verification to read code of other dags |
| CVE-2023-5132 | Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure |
| CVE-2023-51353 | WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control vulnerability |
| CVE-2023-51355 | WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerability |
| CVE-2023-51357 | WordPress Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.0 -... |
| CVE-2023-51359 | WordPress Essential Blocks plugin <= 4.2.0 - Multiple Contributor+ Broken Access Control vulnerability |
| CVE-2023-51360 | WordPress Essential Blocks plugin <= 4.2.0 - Multiple Subscriber+ Broken Access Control vulnerability |
| CVE-2023-51362 | WordPress myStickyElements plugin <= 2.1.3 - Broken Access Control vulnerability |
| CVE-2024-0372 | Views for WPForms <= 3.2.2 - Missing Authorization via get_form_fields |
| CVE-2024-0385 | Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategory |
| CVE-2024-0394 | Rapid7 Minerva Armor Privilege Escalation |
| CVE-2024-0447 | ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Missing Authorization to Settings Update |
| CVE-2024-0679 | ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation |
| CVE-2024-0683 | Bulgarisation for WooCommerce <= 3.0.14 - Missing Authorization |
| CVE-2024-0702 | Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorization |
| CVE-2024-0779 | Enjoy Social Feed <= 6.2.2 - Unauthenticated Arbitrary Instagram Account Unlinking |
| CVE-2024-0780 | Enjoy Social Feed <= 6.2.2 - Subscriber+ Plugin Database Reset |
| CVE-2024-0791 | WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Missing Authorization |
| CVE-2024-0797 | Active Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Missing Authorization |
| CVE-2024-10003 | Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions |
| CVE-2024-10008 | Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization... |
| CVE-2024-10078 | WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions |
| CVE-2024-10092 | Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation |
| CVE-2024-10216 | WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Additio... |
| CVE-2024-10272 | Broken Access Control in lunary-ai/lunary |
| CVE-2024-10274 | Improper Authorization in lunary-ai/lunary |
| CVE-2024-10294 | CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change |
| CVE-2024-10326 | RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets |
| CVE-2024-10330 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-10486 | Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File |
| CVE-2024-1050 | Import and export users and customers <= 1.26.5 - Missing Authorization |
| CVE-2024-10520 | WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion |
| CVE-2024-10527 | Spacer <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosure |
| CVE-2024-10528 | Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update |
| CVE-2024-10529 | Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion |
| CVE-2024-10530 | Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Addition |
| CVE-2024-10531 | Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Update |
| CVE-2024-10532 | Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import |
| CVE-2023-51418 | WordPress JVM rich text icons plugin <= 1.2.6 - Arbitrary File Deletion vulnerability |
| CVE-2023-51494 | WordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerability |
| CVE-2023-51495 | WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability |
| CVE-2023-51496 | WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability |
| CVE-2023-51497 | WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.9 - Broken Access Control vulnerability |
| CVE-2023-51498 | WordPress WooCommerce Canada Post Shipping plugin <= 2.8.3 - Broken Access Control vulnerability |
| CVE-2023-51499 | WordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerability |
| CVE-2023-51500 | WordPress Uncode Core plugin <= 2.8.8 - Arbitrary File Deletion vulnerability |
| CVE-2023-51507 | WordPress Quiz And Survey Master plugin <= 8.1.16 - Broken Access Control vulnerability |
| CVE-2023-51515 | WordPress Uncode Core plugin <= 2.8.8 - Privilege Escalation vulnerability |
| CVE-2023-51516 | WordPress Business Directory Plugin – Easy Listing Directories for WordPress plugin <= 6.3.9 - Broken Access Control vulnera... |
| CVE-2023-51519 | WordPress Slider by Soliloquy – Responsive Image Slider for WordPress plugin <= 2.7.2 - Broken Access Control vulnerability |
| CVE-2023-51523 | WordPress WooCommerce Easy Duplicate Product plugin <= 0.3.0.7 - Broken Access Control vulnerability |
| CVE-2023-51524 | WordPress weForms plugin <= 1.6.18 - Broken Access Control vulnerability |
| CVE-2023-51526 | WordPress Simple Staff List plugin <= 2.2.4 - Broken Access Control vulnerability |
| CVE-2023-51537 | WordPress Awesome Support plugin <= 6.1.5 - Broken Access Control vulnerability |
| CVE-2023-5165 | Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell |
| CVE-2023-51650 | Unauthorized access vulnerability on three interfaces |
| CVE-2023-51670 | WordPress FunnelKit Checkout plugin <= 3.10.3 - Authenticated Arbitrary Plugin Activation vulnerability |
| CVE-2023-51671 | WordPress FunnelKit Checkout plugin <= 3.10.3 - Authenticated Plugin Settings Change vulnerability |
| CVE-2023-51672 | WordPress FunnelKit Checkout plugin <= 3.10.3 - Unauthenticated Arbitrary Post/Page Deletion vulnerability |
| CVE-2023-51679 | WordPress BulkGate SMS Plugin for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability |
| CVE-2023-51680 | WordPress Quotes for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2023-51682 | WordPress MC4WP plugin <= 4.9.9 - Broken Access Control vulnerability |
| CVE-2023-51692 | WordPress Customer Reviews for WooCommerce Plugin <= 5.38.1 is vulnerable to Broken Access Control |
| CVE-2023-52117 | WordPress ProfileGrid plugin <= 5.6.6 - Broken Access Control vulnerability |
| CVE-2023-52177 | WordPress Integrate Google Drive plugin <= 1.3.3 - Broken Access Control vulnerability |
| CVE-2023-52179 | WordPress Product Expiry for WooCommerce plugin <= 2.5 - Broken Access Control vulnerability |
| CVE-2023-52183 | WordPress WordPress Backup & Migration plugin <= 1.4.3 - Broken Access Control vulnerability |
| CVE-2023-52186 | WordPress WooCommerce Product Vendors plugin <= 2.2.2 - Unauthenticated Broken Access Control vulnerability |
| CVE-2023-52199 | WordPress ActivityPub plugin <= 1.0.5 - Unauthenticated Broken Access Control vulnerability |
| CVE-2023-52211 | WordPress WP Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2023-52214 | WordPress Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.3 - Broken Access Control vulnerability |
| CVE-2023-52217 | WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability |
| CVE-2023-52220 | WordPress MonsterInsights plugin <= 8.21.0 - Broken Access Control vulnerability |
| CVE-2023-52224 | WordPress Revolut Gateway for WooCommerce plugin <= 4.9.7 - Broken Access Control vulnerability |
| CVE-2023-52227 | WordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerability |
| CVE-2023-52229 | WordPress Word Replacer Pro plugin <= 1.0 - Broken Access Control vulnerability |
| CVE-2023-52230 | WordPress Booster Plus for WooCommerce plugin < 7.1.3 - Authenticated Arbitrary WordPress Option Disclosure Vulnerability |
| CVE-2023-52232 | WordPress Booster Plus for WooCommerce plugin < 7.1.2 - Authenticated Arbitrary Post/Page Deletion Vulnerability |
| CVE-2023-52233 | WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerability |
| CVE-2023-5251 | Grid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete |
| CVE-2023-5311 | WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification |
| CVE-2023-5314 | WP EXtra <= 6.2 - Missing Authorization to Arbitrary Email Sending |
| CVE-2023-5321 | Missing Authorization in hamza417/inure |
| CVE-2023-5416 | Funnelforms Free <= 3.4 - Missing Authorization to Category Deletion |
| CVE-2023-5417 | Funnelforms Free <= 3.4 - Missing Authorization to Category Update |
| CVE-2023-5419 | Funnelforms Free <= 3.4 - Missing Authorization to Test Email Sending |
| CVE-2023-5425 | Post Meta Data Manager <=1.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation |
| CVE-2023-5426 | Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion |
| CVE-2023-54327 | Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change |
| CVE-2023-5506 | ImageMapper <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page/Post Deletion via imgmap_delete_ar... |
| CVE-2023-5509 | myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion |
| CVE-2023-5905 | DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data export |
| CVE-2023-5949 | SmartCrawl WordPress SEO checker < 3.8.3 - Unauthenticated Password Protected Post Disclosure |
| CVE-2023-6158 | EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta... |
| CVE-2023-6257 | Inline Related Posts < 3.6.0 - Subscriber+ Password Protected Post Read |
| CVE-2023-6279 | Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS |
| CVE-2023-6325 | RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate |
| CVE-2023-6327 | ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products |
| CVE-2023-6369 | Export WP Page to Static HTML/CSS <= 2.1.9 - Missing Authorization via Multiple AJAX Actions |
| CVE-2023-6394 | Quarkus: graphql operations over websockets bypass |
| CVE-2023-6637 | CAOS | Host Google Analytics Locally <= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Update |
| CVE-2023-6638 | GTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update |
| CVE-2023-6696 | Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposur... |
| CVE-2023-6700 | Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2023-6742 | Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images |
| CVE-2023-6748 | Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure |
| CVE-2023-6751 | Hostinger <= 1.9.7 - Missing Authorization to Maintenance Mode Activation |
| CVE-2023-7202 | Fatal Error Notify < 1.5.3 - Subscriber+ Test Error Email Sending |
| CVE-2023-7203 | Smart Forms < 2.6.87 - Subscriber+ Arbitrary Entry Deletion |
| CVE-2023-7268 | ArtPlacer Widget < 2.21.2 - Subscriber+ Arbitrary Widget Deletion |
| CVE-2023-7287 | Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'pt_cancel_subscription' |
| CVE-2023-7288 | Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'update_profile_preference' |
| CVE-2023-7289 | Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_sw_save_api_keys' |
| CVE-2023-7290 | Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_for_verified_profiles' |
| CVE-2023-7291 | Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_account' |
| CVE-2023-7292 | Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_notice_dismiss' |
| CVE-2023-7293 | Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_mollie_account_details' |
| CVE-2023-7294 | Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_profile' |
| CVE-2023-7306 | Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion |
| CVE-2023-7317 | Nagios XI < 2024R1 Web SSH Terminal Missing Access Control |
| CVE-2024-11154 | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Au... |
| CVE-2024-1119 | Order Tip for WooCommerce <= 1.3.1 - Missing Authorization to Unauthenticated Data Export |
| CVE-2024-11194 | Classified Listing – Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary O... |
| CVE-2024-1120 | NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - M... |
| CVE-2024-11205 | WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation |
| CVE-2024-1121 | Advanced Forms for ACF <= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings Export |
| CVE-2024-1122 | Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated... |
| CVE-2024-1123 | EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite |
| CVE-2024-1124 | EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary... |
| CVE-2024-1125 | EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary... |
| CVE-2024-11354 | Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Pla... |
| CVE-2024-11355 | Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Expos... |
| CVE-2024-1136 | Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypass |
| CVE-2024-11401 | Rapid7 Insight Platform Privilege Escalation Vulnerability |
| CVE-2024-11423 | Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch |
| CVE-2024-11443 | de:branding <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2024-11673 | 1000 Projects Bookstore Management System cross-site request forgery |
| CVE-2024-1169 | Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 -... |
| CVE-2024-1170 | Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 -... |
| CVE-2024-11709 | AI Post Generator | AutoWriter <= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletion |
| CVE-2024-11715 | WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation |
| CVE-2024-11724 | Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Mi... |
| CVE-2024-11725 | SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options... |
| CVE-2024-11743 | SourceCodester Best House Rental Management System POST Request ajax.php cross-site request forgery |
| CVE-2024-1175 | WP-Recall – Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_payment |
| CVE-2024-1176 | HT Easy GA4 – Google Analytics WordPress Plugin <= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update |
| CVE-2024-1177 | WP Club Manager – WordPress Sports Club Plugin <= 2.2.10 - Missing Authorization to Unauthenticated Event Permalink Update |
| CVE-2024-1178 | SportsPress – Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update |
| CVE-2024-12071 | Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media <= 1.4.4 - Missing Authorization to Unaut... |
| CVE-2024-12104 | Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subsc... |
| CVE-2024-12110 | Gold Addons for Elementor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) License Activation/Deactivation |
| CVE-2024-12113 | Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs <= 1.3.2 - Missin... |
| CVE-2024-12129 | Royal Core <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2024-12145 | BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion |
| CVE-2024-12155 | SV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update |
| CVE-2024-12158 | Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Missing Authorization to Unauthenticated DB Table... |
| CVE-2024-12164 | WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+... |
| CVE-2024-1217 | Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deacti... |
| CVE-2024-12171 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege... |
| CVE-2024-12172 | WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authoriza... |
| CVE-2024-12176 | WordLift – AI powered SEO – Schema <= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2024-1218 | Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization |
| CVE-2024-12184 | WordPress Contact Forms by Cimatti <= 1.9.4 - Missing Authorization to Unauthenticated Form Submission Download |
| CVE-2024-12190 | Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2... |
| CVE-2024-12201 | Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation |
| CVE-2024-12202 | Croma Music <= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajax |
| CVE-2024-12204 | Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization |
| CVE-2024-12210 | Print Invoice & Delivery Notes for WooCommerce <= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion |
| CVE-2024-12244 | Missing Authorization in GitLab |
| CVE-2024-12249 | GS Insever Portfolio <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection |
| CVE-2024-12253 | Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal <= 3.1.2 - Missing Authorization to Authenticated (Subscr... |
| CVE-2024-12259 | CRM WordPress Plugin – RepairBuddy <= 3.8120 - Missing Authorization to Account Takeover/Privilege Escalation |
| CVE-2024-12263 | Child Theme Creator by Orbisius <= 1.5.5 - Missing Authorization to Authenticated (Subscriber+) Cloud Snippet Update/Delete |
| CVE-2024-12265 | Web3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information Exposure |
| CVE-2024-12266 | ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization |
| CVE-2024-12269 | Safe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Export |
| CVE-2024-1229 | SimpleShop <= 2.10.2 - Missing Authorization |
| CVE-2024-12296 | Apus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_options |
| CVE-2024-12300 | AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload |
| CVE-2024-12316 | Jupiter X Core <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export |
| CVE-2024-12327 | LazyLoad Background Images <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update |
| CVE-2024-12331 | File Manager Pro – Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation |
| CVE-2024-12336 | WC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Sensit... |
| CVE-2024-12341 | Custom Skins Contact Form 7 <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Crea... |
| CVE-2024-12349 | JFinalCMS save cross-site request forgery |
| CVE-2024-12365 | W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery |
| CVE-2024-12413 | MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.0.00 - Missing Authorization |
| CVE-2024-12427 | Multi Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload |
| CVE-2024-12431 | Missing Authorization in GitLab |
| CVE-2024-12535 | Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure |
| CVE-2024-12542 | linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure |
| CVE-2024-12544 | SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.17 - Missing... |
| CVE-2024-12553 | GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability |
| CVE-2024-12558 | WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitiv... |
| CVE-2024-12559 | ClickDesigns <= 1.8.0 - Missing Authorization to API Key Modification or Removal |
| CVE-2024-12594 | ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation |
| CVE-2024-12596 | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) A... |
| CVE-2024-12606 | AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GP... |
| CVE-2024-12610 | School Management System for Wordpress <= 93.0.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion |
| CVE-2024-12611 | School Management System for Wordpress <= 93.0.0 - Reflected Cross-Site Scripting |
| CVE-2024-12616 | Bitly's WordPress Plugin <= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2024-12617 | WC Price History for Omnibus <= 2.1.3 - Missing Authorization |
| CVE-2024-12618 | Newsletter2Go <= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style Reset |
| CVE-2024-12620 | AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations <= 1.4.23 - Missing Authorization to Unauthentic... |
| CVE-2024-12711 | RSVP and Event Management <= 2.7.13 - Missing Authorization |
| CVE-2024-12712 | Shopping Cart & eCommerce Store <= 5.7.8 - Missing Authorization to Order Updates |
| CVE-2024-12713 | SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Discl... |
| CVE-2024-12719 | WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal |
| CVE-2024-12781 | Aurum - WordPress & WooCommerce Shopping Theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content I... |
| CVE-2024-12810 | JobCareer | Job Board Responsive WordPress Theme <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Multiple Admin... |
| CVE-2024-12821 | Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2024-12822 | Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update |
| CVE-2024-12825 | Custom Related Posts <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Private Post Search and Relation Updates |
| CVE-2024-12826 | GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update |
| CVE-2024-12848 | SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload |
| CVE-2024-1285 | Page Builder Sandwich <= 5.1.0 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Post Editing |
| CVE-2024-12855 | AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Atta... |
| CVE-2024-12876 | Golo - Directory & Listing, Travel WordPress Theme <= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthentica... |
| CVE-2024-12879 | WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation |
| CVE-2024-12881 | PlugVersions – Easily rollback to previous versions of your plugins <= 0.0.7 - Missing Authorization to Authenticated (Subscr... |
| CVE-2023-5710 | System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_constants) |
| CVE-2023-5711 | System Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info) |
| CVE-2023-5712 | System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_global_value) |
| CVE-2023-5713 | System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_option_value) |
| CVE-2023-5714 | System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_db_specs) |
| CVE-2023-5737 | WordPress Backup & Migration < 1.4.4 - Subscriber+ Plugin Settings Update |
| CVE-2023-5862 | Missing Authorization in hamza417/inure |
| CVE-2023-6007 | UserPro <= 5.1.1 - Missing Authorization via multiple functions |
| CVE-2023-6020 | Ray Static File Local File Include |
| CVE-2023-6029 | EazyDocs < 2.3.6 - Unauthenticated Arbitrary Posts Deletion and Document Management |
| CVE-2023-6038 | Local File Inclusion in h2oai/h2o-3 |
| CVE-2023-6048 | Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option Update |
| CVE-2023-6066 | WP Custom Widget Area <= 1.2.5 - Subscriber+ Menus Creation/Deletion/Update |
| CVE-2023-6077 | Slider - Ultimate Responsive Image Slider < 3.5.12 - Subscriber+ Arbitrary Post Access |
| CVE-2023-6139 | Essential Real Estate < 4.4.0 - Subscriber+ Denial of Service via Arbitrary Option Update |
| CVE-2023-6554 | Missing authorisation in TCExam |
| CVE-2023-6557 | The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure |
| CVE-2023-6598 | SpeedyCache <= 1.1.3 - Missing Authorization to Plugin Options Update |
| CVE-2023-6600 | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletio... |
| CVE-2023-6798 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing Authorization |
| CVE-2023-6840 | Missing Authorization in GitLab |
| CVE-2023-6855 | Paid Memberships Pro <= 2.12.5 - Missing Authorization via API |
| CVE-2023-6876 | Clever Fox – One Click Website Importer by Nayra Themes <= 25.2.0 - Missing Authorization to arbitrary theme activation via c... |
| CVE-2023-6883 | Easy Social Feed <= 6.5.2 - Missing Authorization to Settings Modification |
| CVE-2023-6955 | Missing Authorization in GitLab |
| CVE-2023-6959 | Getwid – Gutenberg Blocks <= 2.0.4 - Missing Authorization to Recaptcha API Key Modification |
| CVE-2023-6965 | Pods - Custom Content Types and Fields - Missing Authorization |
| CVE-2023-6985 | 10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation |
| CVE-2023-7019 | LightStart – Maintenance Mode, Coming Soon and Landing Page Builder <= 2.6.8 - Missing Authorization |
| CVE-2023-7067 | ShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_store |
| CVE-2023-7068 | WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export |
| CVE-2024-0122 | NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauth... |
| CVE-2024-0138 | NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful exploit o... |
| CVE-2024-0201 | Product Expiry for WooCommerce <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update |
| CVE-2024-0235 | EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure |
| CVE-2024-0236 | EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password Disclosure |
| CVE-2024-0237 | EventON (Free < 2.2.9, Premium <= 4.5.8) - Unauthenticated Virtual Event Settings Update |
| CVE-2024-0238 | EventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata Update |
| CVE-2024-0248 | EazyDocs < 2.4.0 - Subscriber+ Arbitrary Posts Deletion and Document Management |
| CVE-2024-0593 | Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure |
| CVE-2024-0595 | Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users() |
| CVE-2024-0596 | Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html() |
| CVE-2024-0617 | Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount() |
| CVE-2024-0619 | Payflex Payment Gateway <= 2.5.0 - Missing Authorization to Order Status Update |
| CVE-2024-0629 | 2Checkout Payment Gateway for WooCommerce <= 6.2 - Missing Authorization via sniff_ins |
| CVE-2024-0828 | Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Missing Authorization |
| CVE-2024-0829 | Comments Extra Fields For Post,Pages and CPT <= 5.0 - Missing Authorization |
| CVE-2024-0835 | Royal Elementor Kit <= 1.0.116 - Missing Authorization to Arbitrary Transient Update |
| CVE-2024-0836 | WordPress Review & Structure Data Schema Plugin – Review Schema <= 2.1.14 - Missing Authorization to Arbitrary Review Update |
| CVE-2024-0869 | Instant Images <= 6.1.0 - Authenticated (Author+) Arbitrary Options Update |
| CVE-2024-0893 | Schema App Structured Data <= 2.2.0 - Missing Authorization |
| CVE-2024-0900 | Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills R... |
| CVE-2024-0907 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records() |
| CVE-2024-0908 | Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page <= 1.13.4 - Missing Authorization to Information Dis... |
| CVE-2024-0949 | Improper Access Control in Talya Informatics' Elektraweb |
| CVE-2024-0983 | ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in enableOptimization |
| CVE-2024-0984 | ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in disableOptimization |
| CVE-2024-10363 | Improper Access Control in danny-avila/LibreChat |
| CVE-2024-10390 | Elfsight Telegram Chat CC <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting |
| CVE-2024-10399 | Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure |
| CVE-2024-10402 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contr... |
| CVE-2024-1041 | WP Radio – Worldwide Online Radio Stations Directory for WordPress <= 3.1.9 - Authenticated(Subscriber+) Stored Cross-Site Sc... |
| CVE-2024-1042 | WP Radio – Worldwide Online Radio Stations Directory for WordPress <= 3.1.9 - Missing Authorization via multiple AJAX actions |
| CVE-2024-10437 | WPC Smart Messages for WooCommerce <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactiv... |
| CVE-2024-1047 | ThemeIsle SDK <= Various Versions - Missing Authorization |
| CVE-2024-10606 | WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update |
| CVE-2024-10614 | Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation |
| CVE-2024-10629 | GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation |
| CVE-2024-10663 | Eleblog – Elementor Blog And Magazine Addons <= 1.8 - Missing Authorization to Authenticated (Subscriber+) Deactivation Submi... |
| CVE-2024-10664 | Knowledge Base documentation & wiki plugin – BasePress Docs <= 2.16.3.3 - Missing Authorization to Authenticated (Subscriber+... |
| CVE-2024-10665 | Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion |
| CVE-2024-10673 | Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation |
| CVE-2024-10674 | Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation |
| CVE-2024-10717 | Styler for Ninja Forms <= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license |
| CVE-2024-1072 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Au... |
| CVE-2024-10728 | PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation |
| CVE-2024-10762 | Missing Authorization in lunary-ai/lunary |
| CVE-2024-1078 | Quiz Maker <= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modification |
| CVE-2024-10783 | MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation |
| CVE-2024-10786 | Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing |
| CVE-2024-1079 | Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval |
| CVE-2024-10800 | WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation |
| CVE-2024-10802 | Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure |
| CVE-2024-1350 | WordPress Honeypot for WP Comment plugin <= 2.2.3 - Arbitrary File Deletion vulnerability |
| CVE-2024-13513 | Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation |
| CVE-2024-1352 | Classified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorization |
| CVE-2024-13520 | Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.9 - Missing Authorization to Unauthenticated Price, Da... |
| CVE-2024-13526 | EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event At... |
| CVE-2024-13529 | SocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Download |
| CVE-2024-13530 | Custom Login Page Styler <= 7.1.1 - Missing Authorization to Authenticated (Subsciber+) Log Deletion and Session Termination |
| CVE-2024-13541 | aDirectory – WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post... |
| CVE-2024-13554 | The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation |
| CVE-2024-13556 | Affiliate Links: WordPress Plugin for Link Cloaking and Link Management <= 3.0.1 - Missing Authorization to Unauthenticated I... |
| CVE-2024-13719 | PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure |
| CVE-2024-13737 | Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post De... |
| CVE-2024-13746 | Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_... |
| CVE-2024-13747 | WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection |
| CVE-2024-13752 | WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update |
| CVE-2024-13767 | Live2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion |
| CVE-2024-13769 | Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber... |
| CVE-2024-13775 | WooCommerce Support Ticket System <= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and... |
| CVE-2024-13776 | ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited... |
| CVE-2024-13780 | Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary... |
| CVE-2024-13783 | FormCraft <= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php |
| CVE-2024-1380 | Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Ex... |
| CVE-2024-13800 | Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Upd... |
| CVE-2024-13801 | BWL Advanced FAQ Manager <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update |
| CVE-2024-1381 | Page Builder Sandwich – Front End WordPress Page Builder Plugin <= 5.1.0 - Sensitive Information Exposure |
| CVE-2024-13810 | Zass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+)... |
| CVE-2024-13811 | Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subsc... |
| CVE-2024-13816 | Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Mu... |
| CVE-2024-1686 | Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber... |
| CVE-2024-1687 | Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber... |
| CVE-2024-1688 | Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval |
| CVE-2024-1689 | WooCommerce Tools <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation |
| CVE-2024-1690 | TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.4.10 - Missing Author... |
| CVE-2024-1710 | Addon Library <= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload |
| CVE-2024-1716 | Admin Bar Remover <= 1.0.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2024-1717 | Admin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval |
| CVE-2024-1732 | Sharkdropship for AliExpress Dropshipping and Affiliate <= 2.2.4 - Missing Authorization to Unauthenticated Arbitrary Post De... |
| CVE-2024-1733 | Word Replacer Pro <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content Update |
| CVE-2024-1744 | IDOR in Ariva Computer's Accord ORS |
| CVE-2024-1763 | Wp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status Upd... |
| CVE-2024-1771 | Total <= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections Update |
| CVE-2024-1778 | Admin side data storage for Contact Form 7 <= 1.1.1 - Missing Authorization to Unauthenticated Bookmark Status Alteration |
| CVE-2024-1779 | Admin side data storage for Contact Form 7 plugin <= 1.1.1 - Missing Authorization to Unauthenticated Read Status Update |
| CVE-2024-1798 | Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xml |
| CVE-2024-1804 | Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xml |
| CVE-2024-1807 | Product Sort and Display for WooCommerce <= 2.4.1 - Missing Authorization |
| CVE-2024-1843 | Auto Affiliate Links <= 6.4.3 - Missing Authorization via aalAddLink |
| CVE-2024-1844 | RevivePress – Keep your Old Content Evergreen <= 1.5.6 - Missing Authorization |
| CVE-2024-1850 | AI Post Generator | AutoWriter <= 3.3 - Missing Authorization |
| CVE-2024-1851 | affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list |
| CVE-2024-1857 | Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates <= 2.6.6... |
| CVE-2024-1860 | Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.51 - Missing Authorization to... |
| CVE-2024-1861 | Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to... |
| CVE-2024-1862 | WooCommerce Add to Cart Custom Redirect <= 1.2.13 - Authenticated(Contributor+) Missing Authorization to Limited Arbitrary Op... |
| CVE-2024-1870 | Colibri Page Builder <= 1.0.260 - Missing Authorization |
| CVE-2024-1904 | MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts |
| CVE-2024-1934 | WP Compress – Image Optimizer <= 6.11.08 - Missing Authorization to Unauthenticated CDN Modification |
| CVE-2024-1937 | Brizy – Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification |
| CVE-2024-1945 | ARForms Form Builder <= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion |
| CVE-2024-1955 | Hide Dashboard Notifications <= 1.3 - Missing Authorization to Authenticated(Contributor+) Plugin Settings Modification |
| CVE-2024-1982 | WPvivid Backup and Migration <= 0.9.68 - Missing Authorization |
| CVE-2024-1984 | Graphene <= 2.9.2 - Missing Authorization |
| CVE-2024-1991 | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscri... |
| CVE-2024-1994 | Image Watermark <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Watermark Modification |
| CVE-2024-1995 | Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure |
| CVE-2024-2017 | Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP O... |
| CVE-2024-2033 | Video Conferencing with Zoom <= 4.4.5 - Sensitive Information Exposure |
| CVE-2024-2035 | Improper Authorization in zenml-io/zenml |
| CVE-2024-20355 | A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive Secur... |
| CVE-2024-2036 | ApplyOnline – Application Form Builder and Manager <= 2.6.2 - Missing Authorization to Sensitive Information Exposure |
| CVE-2024-20413 | Cisco NX-OS Bash Privilege Escalation Vulnerability |
| CVE-2024-2043 | EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.7 - Missing Authorization to Sensitive Information... |
| CVE-2024-20442 | Cisco Nexus Dashboard Unauthorized API Endpoints Vulnerability |
| CVE-2024-20477 | Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability |
| CVE-2024-2086 | Integrate Google Drive <= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and Export |
| CVE-2024-2107 | Blossom Spa <= 1.3.3 - Sensitive Information Exposure |
| CVE-2024-2109 | Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display |
| CVE-2024-21417 | Windows Text Services Framework Elevation of Privilege Vulnerability |
| CVE-2024-21630 | Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to |
| CVE-2024-21748 | WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerability |
| CVE-2024-21751 | WordPress RabbitLoader plugin <= 2.19.13 - Broken Access Control vulnerability |
| CVE-2024-22151 | WordPress Import and export users and customers plugin <= 1.24.6 - Broken Access Control vulnerability |
| CVE-2024-22156 | WordPress SalesKing plugin <= 1.6.15 - Unauthenticated Plugin Settings Change vulnerability |
| CVE-2024-2222 | Advanced Classifieds & Directory Pro <= 3.0.0 - Missing Authorization to Arbitrary Attachment Deletion |
| CVE-2024-22296 | WordPress 12 Step Meeting List plugin <= 3.14.28 - Broken Access Control vulnerability |
| CVE-2024-22298 | WordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerability |
| CVE-2024-2292 | Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Data |
| CVE-2024-2298 | affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product |
| CVE-2024-23503 | WordPress Ninja Tables plugin <= 5.0.6 - Broken Access Control vulnerability |
| CVE-2024-23504 | WordPress Ninja Tables plugin <= 5.0.5 - Broken Access Control vulnerability |
| CVE-2024-23518 | WordPress ACF Photo Gallery Field plugin <= 2.6 - Broken Access Control vulnerability |
| CVE-2024-23520 | WordPress PopupAlly plugin <= 2.1.0 - Broken Access Control vulnerability |
| CVE-2024-23521 | WordPress Happyforms plugin <= 1.25.10 - Broken Access Control vulnerability |
| CVE-2024-23524 | WordPress PilotPress plugin <= 2.0.30 - Broken Access Control vulnerability |
| CVE-2024-23944 | Apache ZooKeeper: Information disclosure in persistent watcher handling |
| CVE-2024-2395 | Bulgarisation for WooCommerce <= 3.0.14 - Cross-Site Request Forgery |
| CVE-2024-2417 | User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization... |
| CVE-2024-24703 | WordPress MultiVendorX plugin <= 4.0.25 - Broken Access Control vulnerability |
| CVE-2024-24704 | WordPress Load More Anything plugin <= 3.3.3 - Broken Access Control vulnerability |
| CVE-2024-24709 | WordPress Shareaholic plugin <= 9.7.11 - Broken Access Control vulnerability |
| CVE-2024-24710 | WordPress Feed Them Social plugin <= 4.2.0 - Broken Access Control vulnerability |
| CVE-2024-24711 | WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability |
| CVE-2024-24716 | WordPress Awesome Support plugin <= 6.1.6 - Broken Access Control vulnerability |
| CVE-2024-24718 | WordPress PropertyHive plugin <= 2.0.6 - Missing Authorization to Non-Arbitrary Plugin Installation vulnerability |
| CVE-2024-24719 | WordPress Kikote plugin <= 1.8.9 - Broken Access Control vulnerability |
| CVE-2024-24739 | Missing authorization check in SAP BAM (Bank Account Management) |
| CVE-2024-24741 | Missing Authorization check in SAP Master Data Governance Material |
| CVE-2024-2476 | OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion |
| CVE-2024-24799 | WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2024-24805 | WordPress WP Dummy Content Generator plugin <= 3.1.2 - Broken Access Control vulnerability |
| CVE-2024-24822 | Pimcore Admin Classic Bundle permissions are not getting checked when working with tags |
| CVE-2024-24832 | WordPress EventPrime plugin <= 3.3.9 - Broken Access Control vulnerability |
| CVE-2024-24833 | WordPress Happy Addons for Elementor plugin <= 3.10.1 - Broken Access Control on Post Clone vulnerability |
| CVE-2024-24835 | WordPress BEAR plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2024-24840 | WordPress Element Pack Elementor Addons plugin <= 5.4.11 - Broken Access Control on Duplicate Post vulnerability |
| CVE-2024-24844 | WordPress PowerPack Pro for Elementor plugin <= 2.10.6 - Unauthenticated Plugin Settings Reset vulnerability |
| CVE-2024-24850 | WordPress Quicksand Post Filter jQuery plugin <= 3.1.1 - Broken Access Control vulnerability |
| CVE-2024-24883 | WordPress Prime Slider plugin <= 3.11.10 - Broken Access Control on Duplicate Post vulnerability |
| CVE-2024-2508 | WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification |
| CVE-2024-25092 | WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability |
| CVE-2024-2544 | Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions |
| CVE-2024-25643 | Missing authorization check in SAP Fiori app (My Overtime Requests) |
| CVE-2024-25907 | WordPress WP Media folder plugin <= 5.7.2 - Plugin Settings Change vulnerability |
| CVE-2024-25908 | WordPress WP Media folder plugin <= 5.7.2 - Subscriber+ Arbitrary Post/Page Modification vulnerability |
| CVE-2024-25911 | WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary File Deletion vulnerability |
| CVE-2024-25912 | WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary WordPress Settings Change vulnerability |
| CVE-2024-25922 | WordPress Peach Payments Gateway plugin <= 3.1.9 - Broken Access Control vulnerability |
| CVE-2024-25929 | WordPress Product Catalog Mode For Woocommerce plugin <= 5.0.5 - Broken Access Control vulnerability |
| CVE-2024-25935 | WordPress RegistrationMagic plugin <= 5.2.5.9 - Broken Access Control vulnerability |
| CVE-2024-26138 | License information is public, exposing instance id and license holder details |
| CVE-2024-2619 | Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection |
| CVE-2024-2702 | WordPress Olive One Click Demo Import plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2024-27190 | WordPress Download Media plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2024-2771 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Se... |
| CVE-2024-2782 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Se... |
| CVE-2024-27900 | Missing Authorization check in SAP ABAP Platform |
| CVE-2024-27906 | Apache Airflow: Dag Code and Import Error Permissions Ignored |
| CVE-2024-27910 | A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer witho... |
| CVE-2024-27911 | A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to obtain the administrator... |
| CVE-2024-27939 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow the upload of arb... |
| CVE-2024-27950 | WordPress Sirv plugin <= 7.2.0 - Broken Access Control vulnerability |
| CVE-2024-27953 | WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.6.8 is vulnerable to Broken Access Control |
| CVE-2024-2797 | MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization |
| CVE-2024-27970 | WordPress WP SendFox plugin <= 1.3.0 - Broken Access Control vulnerability |
| CVE-2024-28003 | WordPress Max Mega Menu plugin <= 3.3 - Broken Access Control vulnerability |
| CVE-2024-28004 | WordPress Colibri Page Builder plugin <= 1.0.248 - Broken Access Control vulnerability |
| CVE-2024-28167 | Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data) |
| CVE-2024-28215 | nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could... |
| CVE-2024-28216 | nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could... |
| CVE-2024-2844 | Easy Appointments <= 3.11.18 - Insufficient Authorization |
| CVE-2024-2848 | Responsive <= 5.0.2 - Missing Authorization to HTML Injection |
| CVE-2024-2882 | Missing Authorization in SDG Technologies PnPSCADA |
| CVE-2024-2906 | WordPress Radio Player plugin <= 2.0.73 - Unauthenticated Broken Access Control vulnerability |
| CVE-2024-29228 | Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and... |
| CVE-2024-29229 | Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 an... |
| CVE-2024-29240 | Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.... |
| CVE-2024-29241 | Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-1... |
| CVE-2024-2962 | Networker - Tech News WordPress Theme with Dark Mode <= 1.1.9 - Missing Authorization |
| CVE-2024-30216 | Missing Authorization check in SAP S/4 HANA (Cash Management) |
| CVE-2024-30217 | Missing Authorization check in SAP S/4 HANA (Cash Management) |
| CVE-2024-30234 | WordPress WholesaleX plugin <= 1.3.1 - Broken Access Control vulnerability |
| CVE-2024-30235 | WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.0 - Broken Access Control vulnerability |
| CVE-2024-30459 | WordPress AI WP Writer plugin <= 3.6.5 - Broken Access Control vulnerability |
| CVE-2024-30463 | WordPress BEAR plugin <= 1.1.4.3 - Broken Access Control vulnerability |
| CVE-2024-30464 | WordPress Social Icons Widget & Block by WPZOOM plugin <= 4.2.15 - Broken Access Control vulnerability |
| CVE-2024-30465 | WordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerability |
| CVE-2024-30466 | WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.4 - Broken Access Control vulnerability |
| CVE-2024-30467 | WordPress Essential Blocks plugin <= 4.4.9 - Broken Access Control vulnerability |
| CVE-2024-30470 | WordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerability |
| CVE-2024-30477 | WordPress Klarna Payments for WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability |
| CVE-2024-30484 | WordPress RT Easy Builder plugin <= 2.0 - Broken Access Control vulnerability |
| CVE-2024-30485 | WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability |
| CVE-2024-30487 | WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1 - Broken Access Control vulnerability |
| CVE-2024-30505 | WordPress Church Admin plugin <= 4.1.18 - Broken Access Control vulnerability |
| CVE-2024-30508 | WordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerability |
| CVE-2024-30512 | WordPress weForms plugin <= 1.6.20 - Broken Access Control vulnerability |
| CVE-2024-30515 | WordPress Events Manager plugin <= 6.4.6.4 - Broken Access Control vulnerability |
| CVE-2024-30517 | WordPress Sliced Invoices plugin <= 3.9.2 - Broken Access Control vulnerability |
| CVE-2024-30525 | WordPress Move Addons for Elementor plugin <= 1.2.9 - Broken Access Control vulnerability |
| CVE-2024-30528 | WordPress Spiffy Calendar plugin <= 4.9.10 - Broken Access Control vulnerability |
| CVE-2024-30529 | WordPress Tainacan plugin <= 0.20.7 - Broken Access Control vulnerability |
| CVE-2024-30534 | WordPress Calendarista Basic Edition plugin <= 3.0.5 - Broken Access Control vulnerability |
| CVE-2024-30537 | WordPress WPC Badge Management for WooCommerce plugin <= 2.4.0 - Broken Access Control vulnerability |
| CVE-2024-30538 | WordPress DELUCKS SEO plugin <= 2.5.4 - Broken Access Control vulnerability |
| CVE-2024-30539 | WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability |
| CVE-2024-30544 | WordPress Whizzy plugin <= 1.1.18 - Broken Access Control vulnerability |
| CVE-2024-3071 | ACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update |
| CVE-2024-3072 | ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update |
| CVE-2024-3097 | WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure |
| CVE-2024-31098 | WordPress New Order Notification for Woocommerce plugin <= 2.0.2 - Broken Access Control vulnerability |
| CVE-2024-31099 | WordPress Phlox Core Elements plugin <= 2.15.7 - Broken Access Control vulnerability |
| CVE-2024-31118 | WordPress SP Project & Document Manager plugin <= 4.70 - Broken Access Control to XSS vulnerability |
| CVE-2024-3115 | Exposure of Sensitive Information to an Unauthorized Actor in GitLab |
| CVE-2024-31230 | WordPress ShortPixel Adaptive Images plugin <= 3.8.2 - Broken Access Control vulnerability |
| CVE-2024-31242 | WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary Email Sending vulnerability |
| CVE-2024-31243 | WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Setting Deletion vulnerability |
| CVE-2024-31244 | WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Settings Change vulnerability |
| CVE-2024-31246 | WordPress PostX plugin <= 3.2.3 - Author+ Post/Page Duplication vulnerability |
| CVE-2024-31248 | WordPress All-in-One Video Gallery plugin <= 3.5.2 - Broken Access Control vulnerability |
| CVE-2024-31252 | WordPress Responsive Lightbox & Gallery plugin <= 2.4.6 - Broken Access Control vulnerability |
| CVE-2024-31261 | WordPress Announcer – Notification & message bars plugin <= 6.0 - Broken Access Control vulnerability |
| CVE-2024-31267 | WordPress Flexible Checkout Fields for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability |
| CVE-2024-31270 | WordPress ARForms Form Builder plugin <= 1.6.1 - Broken Access Control vulnerability |
| CVE-2024-31273 | WordPress JS Help Desk plugin <= 2.8.3 - Broken Access Control vulnerability |
| CVE-2024-31274 | WordPress EmbedPress plugin <= 3.9.11 - Broken Access Control vulnerability |
| CVE-2024-31275 | WordPress EventPrime plugin <= 3.3.4 - Booking Price Manipulation vulnerability |
| CVE-2024-31276 | WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.8 - Broken Access Control vulnerability |
| CVE-2024-31281 | WordPress Church Admin plugin <= 4.1.6 - Broken Access Control vulnerability |
| CVE-2024-31283 | WordPress Advanced Local Pickup for WooCommerce plugin <=1.6.2 - Broken Access Control vulnerability |
| CVE-2024-31284 | WordPress EmbedPress plugin <= 3.9.8 - Broken Access Control vulnerability |
| CVE-2024-31294 | WordPress WP Sort Order plugin <= 1.3.1 - Broken Access Control vulnerability |
| CVE-2024-31297 | WordPress Wholesale For WooCommerce plugin <= 2.3.1 - Unauthenticated Arbitrary Post/Page vulnerability |
| CVE-2024-31304 | WordPress MultiVendorX Marketplace <= 4.1.3 - Broken Access Control vulnerability |
| CVE-2024-31307 | WordPress Easy Social Share Buttons plugin <= 9.4 - Multiple Broken Access Control vulnerability |
| CVE-2024-31342 | WordPress Gallery Exporter plugin <= 1.3 - Arbitrary File Download vulnerability |
| CVE-2024-31343 | WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10.1 - Arbitrary File Download vulnerability |
| CVE-2024-31347 | WordPress Tracking Code Manager plugin <= 2.1.0 - Broken Access Control vulnerability |
| CVE-2024-31350 | WordPress AWP Classifieds plugin <= 4.3.1 - Broken Access Control vulnerability |
| CVE-2024-31352 | WordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerability |
| CVE-2024-31358 | WordPress 5 Stars Rating Funnel plugin <= 1.2.67 - Arbitrary Content Deletion vulnerability |
| CVE-2024-31359 | WordPress Premmerce Product Filter for WooCommerce plugin <= 3.7.2 - Broken Access Control vulnerability |
| CVE-2024-31366 | WordPress Post Type Builder (PTB) plugin <= 2.0.8 - Auth. Arbitrary Post/Page Creation vulnerability |
| CVE-2024-31367 | WordPress Soledad theme <= 8.4.2 - Authenticated Broken Access Control vulnerability |
| CVE-2024-31368 | WordPress Soledad theme <= 8.4.2 - Unauthenticated Broken Access Control vulnerability |
| CVE-2024-31375 | WordPress WP2LEADS plugin <= 3.2.7 - Broken Access Control vulnerability |
| CVE-2024-31421 | WordPress Popup by Supsystic plugin <= 1.10.27 - Broken Access Control vulnerability |
| CVE-2024-31423 | WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.5 - Broken Access Control vulnerability |
| CVE-2024-31432 | WordPress Restrict Content plugin <= 3.2.8 - Broken Access Control vulnerability |
| CVE-2024-31435 | WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.6 - Broken Access Control vulnerability |
| CVE-2024-31981 | XWiki Platform: Privilege escalation (PR) from user registration through PDFClass |
| CVE-2024-31983 | XWiki Platform: Remote code execution from edit in multilingual wikis via translations |
| CVE-2024-31987 | XWiki Platform remote code execution from account via custom skins support |
| CVE-2024-31997 | XWiki Platform remote code execution from account through UIExtension parameters |
| CVE-2024-3206 | Different Menu in Different Pages – Control Menu Visibility (All in One) <= 2.3.2 - Missing Authorization to Menu Duplication |
| CVE-2024-32081 | WordPress Filter Custom Fields & Taxonomies Light plugin <= 1.05 - Broken Access Control vulnerability |
| CVE-2024-3213 | Relevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update |
| CVE-2024-32142 | WordPress Ovic Responsive WPBakery plugin <= 1.3.0 - Broken Access Control vulnerability |
| CVE-2024-32143 | WordPress Podlove Podcast Publisher plugin <= 4.1.0 - Broken Access Control vulnerability |
| CVE-2024-32144 | WordPress Welcart e-Commerce plugin <= 2.9.14 - Broken Access Control vulnerability |
| CVE-2024-32146 | WordPress Aspose.Words – Import and Export word documents plugin <= 6.3.1 - Broken Access Control vulnerability |
| CVE-2024-32148 | WordPress Pardot plugin <= 2.1.0 - Broken Access Control vulnerability |
| CVE-2024-3216 | WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticat... |
| CVE-2024-3233 | Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation |
| CVE-2024-3235 | Essential Grid <= 3.1.1 - Unauthenticated Private Post Disclosure |
| CVE-2024-3237 | ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update |
| CVE-2024-3243 | Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending |
| CVE-2024-32432 | WordPress Ovic Addon Toolkit plugin <= 2.6.1 - Broken Access Control vulnerability |
| CVE-2024-32455 | WordPress Fatal Error Notify plugin <= 1.5.2 - Broken Access Control vulnerability |
| CVE-2024-32466 | Tolgee's API key scopes not checked when querying translation data |
| CVE-2024-3249 | Zita Elementor Site Library <= 1.6.2 - Missing Authorization to Page Creation and Options Modification |
| CVE-2024-32509 | WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.76 - Broken Access Control vulnerability |
| CVE-2024-32515 | WordPress Mega Addons For Elementor plugin <= 1.8 - Broken Access Control vulnerability |
| CVE-2024-32516 | WordPress Multi Currency For WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability |
| CVE-2024-32517 | WordPress Custom Thank You Page Customize For WooCommerce by Binary Carpenter plugin <= 1.4.12 - Broken Access Control vulner... |
| CVE-2024-32518 | WordPress PeproDev Ultimate Invoice plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2024-32519 | WordPress GG Woo Feed for WooCommerce plugin <= 1.2.6 - Broken Access Control vulnerability |
| CVE-2024-32520 | WordPress WPC Grouped Product for WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability |
| CVE-2024-32522 | WordPress Open Close WooCommerce Store plugin <= 4.9.1 - Broken Access Control vulnerability |
| CVE-2024-32524 | WordPress Custom Order Statuses for WooCommerce plugin <= 1.5.2 - Broken Access Control vulnerability |
| CVE-2024-32525 | WordPress Theme My Login plugin <= 7.1.6 - Broken Access Control vulnerability |
| CVE-2024-32532 | WordPress Speed Optimizer plugin <= 7.4.6 - Broken Access Control vulnerability |
| CVE-2024-32589 | WordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Broken Access Control to XSS vulnerability |
| CVE-2024-32601 | WordPress Popup Anything plugin <= 2.8 - Broken Access Control vulnerability |
| CVE-2024-32656 | Ant Media Server vulnerable to local privilege escalation |
| CVE-2024-32675 | WordPress Order Limit for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2024-32677 | WordPress LoginPress Pro plugin < 3.0.0 - Unauth. License Activation/Deactivation vulnerability |
| CVE-2024-32678 | WordPress TrackShip for WooCommerce plugin <= 1.7.5 - Broken Access Control vulnerability |
| CVE-2024-32679 | WordPress Shared Files plugin <= 1.7.16 - Broken Access Control vulnerability |
| CVE-2024-3268 | YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary... |
| CVE-2024-32681 | WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerability |
| CVE-2024-32682 | WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerability |
| CVE-2024-32684 | WordPress WP Ultimate Review plugin <= 2.2.5 - Broken Access Control on Review vulnerability |
| CVE-2024-32687 | WordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.0.3 - Broken Access Control vulnerability |
| CVE-2024-32688 | WordPress MyRewards plugin <= 5.3.0 - Broken Access Control vulnerability |
| CVE-2024-32689 | WordPress WP Social Comments plugin <= 1.7.3 - Broken Access Control vulnerability |
| CVE-2024-32691 | WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.2 - Broken Access Control vulnerability |
| CVE-2024-32692 | WordPress Chauffeur Taxi Booking System for WordPress plugin <= 6.9 - Broken Authentication vulnerability |
| CVE-2024-32701 | WordPress InstaWP Connect plugin <= 0.1.0.24 - Broken Access Control vulnerability |
| CVE-2024-32703 | WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary File Deletion vulnerability |
| CVE-2024-32704 | WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary WordPress Options Removal vulnerability |
| CVE-2024-32705 | WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary Plugin Activation/Deactivation Vulnerability |
| CVE-2024-32712 | WordPress Podlove Podcast Publisher plugin <= 4.0.14 - Broken Access Control vulnerability |
| CVE-2024-32713 | WordPress AI Post Generator | AutoWriter plugin <= 3.3 - Broken Access Control vulnerability |
| CVE-2024-32714 | WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control vulnerability |
| CVE-2024-32715 | WordPress Olive One Click Demo Import plugin <= 1.1.1 - Arbitrary File Download vulnerability |
| CVE-2024-32717 | WordPress SchedulePress plugin <= 5.0.8 - Broken Access Control vulnerability |
| CVE-2024-32719 | WordPress WP Club Manager plugin <= 2.2.11 - Broken Access Control vulnerability |
| CVE-2024-32724 | WordPress SharkDropship and Affiliate for AliExpress, eBay, Amazon, Etsy plugin <= 2.1.1 - Arbitrary Content Deletion vulnera... |
| CVE-2024-32725 | WordPress 5 Stars Rating Funnel plugin 1.2.67 - Broken Access Control vulnerability |
| CVE-2024-32727 | WordPress RomethemeForm For Elementor plugin <= 1.1.2 - Broken Access Control vulnerability |
| CVE-2024-32730 | Missing authorization check in SAP Enable Now Manager |
| CVE-2024-32731 | Missing Authorization check in SAP My Travel Requests |
| CVE-2024-3275 | eRoom – Zoom Meetings & Webinar <= 1.4.18 - Missing Authorization to Information Exposure |
| CVE-2024-3277 | Yumpu ePaper publishing <= 2.0.24 - Missing Authorization to PDF Upload, Publishing, and API Key Modification |
| CVE-2024-32776 | WordPress AppPresser plugin <= 4.3.0 - Broken Access Control vulnerability |
| CVE-2024-32777 | WordPress BizPrint plugin <= 4.3.39 - Broken Access Control vulnerability |
| CVE-2024-32778 | WordPress Contest Gallery plugin <= 21.3.4 - Arbitrary File Deletion vulnerability |
| CVE-2024-32779 | WordPress Vision – Image Map Builder plugin <= 1.7.1 - Broken Access Control vulnerability |
| CVE-2024-32783 | WordPress Advanced Testimonial Carousel for Elementor plugin <= 3.0.0 - Broken Access Control vulnerability |
| CVE-2024-32784 | WordPress CookieHub plugin <= 1.1.0 - Broken Access Control vulnerability |
| CVE-2024-32787 | WordPress Secure Copy Content Protection and Content Locking plugin <= 3.7.1 - Broken Access Control vulnerability |
| CVE-2024-32792 | WordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerability |
| CVE-2024-32797 | WordPress WP LinkedIn Auto Publish plugin <= 8.11 - Broken Access Control vulnerability |
| CVE-2024-32798 | WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability |
| CVE-2024-32799 | WordPress Easy Property Listings plugin <= 3.5.3 - Broken Access Control vulnerability |
| CVE-2024-32802 | WordPress Better Messages plugin <= 2.4.32 - Broken Authentication vulnerability |
| CVE-2024-32804 | WordPress WP GoToWebinar plugin <= 14.46 - Broken Access Control vulnerability |
| CVE-2024-32805 | WordPress Social Snap plugin <= 1.3.5 - Broken Access Control vulnerability |
| CVE-2024-32810 | WordPress ShortPixel Critical CSS plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2024-32813 | WordPress Integrate Google Drive plugin <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2024-32814 | WordPress Advanced Local Pickup for WooCommerce plugin <= 1.6.1 - Broken Access Control vulnerability |
| CVE-2024-32818 | WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Broken Access Control vulnerability |
| CVE-2024-32820 | WordPress Social Share Icons & Social Share Buttons plugin <= 3.6.2 - Broken Access Control lead to Notice Dismissal vulnerab... |
| CVE-2024-32821 | WordPress Total Poll Lite plugin <= 4.9.9 - Broken Access Control vulnerability |
| CVE-2024-32822 | WordPress Reviews Plus plugin <= 1.3.4 - Broken Access Control vulnerability |
| CVE-2024-32824 | WordPress Evergreen Content Poster plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2024-32826 | WordPress VK Block Patterns plugin <= 1.31.0 - Broken Access Control vulnerability |
| CVE-2024-32828 | WordPress Table Rate Shipping Method for WooCommerce by Flexible Shipping plugin <= 4.24.15 - Broken Access Control vulnerabi... |
| CVE-2024-32829 | WordPress Data Tables Generator by Supsystic plugin <= 1.10.31 - Broken Access Control vulnerability |
| CVE-2024-32832 | WordPress Login with Phone Number plugin <= 1.6.93 - Broken Access Control vulnerability |
| CVE-2024-3287 | SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization |
| CVE-2024-32948 | WordPress ARMember – Membership Plugin plugin <= 4.0.28 - Broken Access Control vulnerability |
| CVE-2024-32949 | WordPress Integrate Google Drive plugin <= 1.3.8 - Broken Access Control vulnerability |
| CVE-2024-3295 | User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization... |
| CVE-2024-32951 | WordPress Max Addons Pro for Bricks plugin <= 1.6.1 - Unauthenticated Plugin Settings Reset vulnerability |
| CVE-2024-32957 | WordPress Page Builder: Live Composer plugin <= 1.5.38 - Broken Access Control vulnerability |
| CVE-2024-33000 | Missing Authorization check in SAP Bank Account Management |
| CVE-2024-33005 | Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server |
| CVE-2024-3305 | IDOR in Utarit Information's SoliClub |
| CVE-2024-3312 | Easy Custom Auto Excerpt <= 2.4.12 - Sensitive Information Exposure |
| CVE-2024-33543 | WordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerability |
| CVE-2024-33545 | WordPress WZone plugin <= 14.0.10 - Unauthenticated Broken Access Control vulnerability |
| CVE-2024-33547 | WordPress WZone plugin <= 14.0.10 - Site Wide Broken Access Control vulnerability |
| CVE-2024-33555 | WordPress XStore Core plugin <= 5.3.8 - Multiple Authenticated Broken Access Control vulnerability |
| CVE-2024-33558 | WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability |
| CVE-2024-33561 | WordPress XStore theme <= 9.3.8 - Unauthenticated Broken Access Control vulnerability |
| CVE-2024-33563 | WordPress XStore theme <= 9.3.8 - Broken Access Control vulnerability |
| CVE-2024-33564 | WordPress XStore theme <= 9.3.8 - Arbitrary Option Update vulnerability |
| CVE-2024-33565 | WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.5.3 - Unauthenticated Broken Access Control vulnerabilit... |
| CVE-2024-33566 | WordPress OrderConvo plugin <= 12.4 - Unauthenticated API Access to Arbitrary File Upload vulnerability |
| CVE-2024-33570 | WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability |
| CVE-2024-33572 | WordPress Nexter Blocks plugin <= 3.2.5 - Broken Access Control vulnerability |
| CVE-2024-33573 | WordPress EPROLO Dropshipping plugin <= 1.7.1 - Broken Access Control vulnerability |
| CVE-2024-33574 | WordPress Vitepos plugin <= 3.0.1 - Broken Access Control vulnerability |
| CVE-2024-33576 | WordPress WPPizza plugin <= 3.18.10 - Broken Access Control vulnerability |
| CVE-2024-33585 | WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 2.12.1 - Broken Access Control vulnerability |
| CVE-2024-33586 | WordPress Photo Gallery by 10Web plugin <= 1.8.20 - Broken Access Control vulnerability |
| CVE-2024-33587 | WordPress Secure Copy Content Protection and Content Locking plugin <= 3.9.0 - Broken Access Control vulnerability |
| CVE-2024-33588 | WordPress basepress plugin <= 2.16.1 - Broken Access Control vulnerability |
| CVE-2024-33589 | WordPress KB Support plugin <= 1.6.0 - Broken Access Control vulnerability |
| CVE-2024-33591 | WordPress Easy Accept Payments for PayPal plugin <= 4.9.10 - Broken Access Control vulnerability |
| CVE-2024-33593 | WordPress Smart Forms plugin <= 2.6.91 - Broken Access Control vulnerability |
| CVE-2024-33594 | WordPress Leaky Paywall plugin <= 4.20.8 - Price Manipulation vulnerability |
| CVE-2024-33595 | WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on Duplicate Post vulnerability |
| CVE-2024-33596 | WordPress Five Star Restaurant Reservations plugin <= 2.6.16 - Broken Access Control vulnerability |
| CVE-2024-33597 | WordPress SSU plugin <= 1.5.0 - Broken Access Control vulnerability |
| CVE-2024-33635 | WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Arbitrary Post/Page Deletion vulnerability |
| CVE-2024-33636 | WordPress WP Page Post Widget Clone plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2024-33652 | WordPress Client Dash plugin <= 2.2.1 - Broken Access Control vulnerability |
| CVE-2024-33684 | WordPress Save as PDF plugin by Pdfcrowd plugin <= 3.2.0 - Broken Access Control to Stored XSS vulnerability |
| CVE-2024-33685 | WordPress Startupzy theme <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2024-33686 | Broken Access Control vulnerability affecting multiple WordPress themes by Extend Themes |
| CVE-2024-33907 | WordPress Print My Blog plugin <= 3.26.2 - Broken Access Control vulnerability |
| CVE-2024-33908 | WordPress WidgetKit plugin <= 2.5.0 - Broken Access Control vulnerability |
| CVE-2024-33909 | WordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerability |
| CVE-2024-33910 | WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Broken Access Control vulnerability |
| CVE-2024-33912 | WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control on Paid Courses vulnerability |
| CVE-2024-33914 | WordPress Exclusive Addons for Elementor plugin <= 2.6.9.1 - Broken Access Control on Post Duplication vulnerability |
| CVE-2024-33915 | WordPress Debug Log Manager plugin <= 2.3.1 - Broken Access Control vulnerability |
| CVE-2024-33919 | WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Broken Access Control vulnerability |
| CVE-2024-33920 | WordPress Democracy Poll plugin <= 6.0.3 - Broken Access Control vulnerability |
| CVE-2024-33923 | WordPress SP Project & Document Manager plugin <= 4.69 - Broken Access Control vulnerability |
| CVE-2024-33925 | WordPress Embed Google Fonts plugin <= 3.1.0 - Broken Access Control vulnerability |
| CVE-2024-33929 | WordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerability |
| CVE-2024-33931 | WordPress JW Player for WordPress plugin <= 2.3.3 - Broken Access Control vulnerability |
| CVE-2024-33937 | WordPress Progressive WordPress (PWA) plugin <= 2.1.13 - Broken Access Control vulnerability |
| CVE-2024-33938 | WordPress Sliding Widgets plugin <= 1.5.0 - Broken Access Control to XSS vulnerability |
| CVE-2024-33941 | WordPress iPanorama 360 plugin <= 1.8.1 - Broken Access Control vulnerability |
| CVE-2024-33942 | WordPress Google Typography plugin <= 1.1.2 - Broken Access Control vulnerability |
| CVE-2024-33944 | WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerabilit... |
| CVE-2024-33956 | WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Broken Access Control vulnerability |
| CVE-2024-34371 | WordPress Login with phone number plugin <= 1.7.18 - Broken Access Control vulnerability |
| CVE-2024-34372 | WordPress Post Grid Master plugin <= 3.4.7 - Broken Access Control vulnerability |
| CVE-2024-34377 | WordPress Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2024-34378 | WordPress LeadConnector plugin <= 1.7 - API Broken Access Control vulnerability |
| CVE-2024-34387 | WordPress WP Post Author plugin <= 3.6.4 - Rating Value Manipulation vulnerability |
| CVE-2024-34389 | WordPress WP Post Author plugin <= 3.6.4 - Broken Access Control vulnerability |
| CVE-2024-34435 | WordPress Aiomatic plugin <= 1.9.3 - Broken Access Control vulnerability |
| CVE-2024-34438 | WordPress Shared Files plugin <= 1.7.19 - Broken Access Control vulnerability |
| CVE-2024-34442 | WordPress weDocs plugin <= 2.1.4 - Broken Access Control vulnerability |
| CVE-2024-34444 | WordPress Slider Revolution plugin < 6.7.0 - Unauthenticated Broken Access Control vulnerability |
| CVE-2024-34690 | Missing Authorization check in SAP Student Life Cycle Management (SLcM) |
| CVE-2024-34691 | Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files) |
| CVE-2024-34753 | WordPress Radio Player plugin <= 2.0.73 - Broken Access Control vulnerability |
| CVE-2024-34758 | WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control vulnerability |
| CVE-2024-34763 | WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin <= 1.01.5 - Broken Access Control vulnerability |
| CVE-2024-34768 | WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerability |
| CVE-2024-34799 | WordPress BookingPress plugin <= 1.0.82 - Appointment Duration Manipulation vulnerability |
| CVE-2024-34800 | WordPress Crafthemes Demo Import plugin <= 3.3 - Arbitrary plugin Installation vulnerability |
| CVE-2024-34802 | WordPress AdFoxly plugin <= 1.8.5 - Broken Access Control vulnerability |
| CVE-2024-34803 | WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerability |
| CVE-2024-34804 | WordPress Tagembed plugin <= 5.8 - Broken Access Control vulnerability |
| CVE-2024-34813 | WordPress WooCommerce Wishlist plugin <= 1.7.8 - Broken Access Control vulnerability |
| CVE-2024-34815 | WordPress Import and export users and customers plugin <= 1.26.5 - Broken Access Control vulnerability |
| CVE-2024-34819 | WordPress MC Woocommerce Wishlist plugin <= 1.7.2 - Broken Access Control vulnerability |
| CVE-2024-34820 | WordPress If-So Dynamic Content Personalization plugin <= 1.7.1 - Broken Access Control vulnerability |
| CVE-2024-34821 | WordPress Contact List plugin <= 2.9.87 - Broken Access Control vulnerability |
| CVE-2024-34822 | WordPress weMail plugin <= 1.14.2 - Broken Access Control vulnerability |
| CVE-2024-34824 | WordPress SportsPress – Sports Club & League Manager plugin <= 2.7.20 - Broken Access Control vulnerability |
| CVE-2024-34826 | WordPress CF7 WOW Styler plugin <= 1.6.4 - Broken Access Control vulnerability |
| CVE-2024-35168 | WordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerability |
| CVE-2024-35174 | WordPress Flo Forms plugin <= 1.0.42 - Broken Access Control vulnerability |
| CVE-2024-3520 | Country State City Dropdown CF7 <= 2.7.1 - Missing Authorization |
| CVE-2024-35237 | MIT IdentiBot User-Kerberos Mapping Publicly Available |
| CVE-2024-3546 | WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal |
| CVE-2024-3553 | Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update |
| CVE-2024-3555 | Social Link Pages: link-in-bio landing pages for your social media profiles <= 1.6.9 - Missing Authorization to Arbitrary Pag... |
| CVE-2024-35628 | WordPress Photo Gallery by 10Web plugin <= 1.8.25 - Broken Access Control vulnerability |
| CVE-2024-35659 | WordPress KiviCare plugin <= 3.6.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-35660 | WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerability |
| CVE-2024-35661 | WordPress Upload Fields for WPForms plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2024-35662 | WordPress Simple COD Fees for WooCommerce plugin <= 2.0.2 - Broken Access Control vulnerability |
| CVE-2024-35663 | WordPress WP Translate plugin <= 5.3.0 - Broken Access Control vulnerability |
| CVE-2024-35665 | WordPress Insert Post Ads plugin <= 1.3.2 - Broken Access Control vulnerability |
| CVE-2024-35667 | WordPress Shopping Cart & eCommerce Store plugin <= 5.5.19 - Broken Access Control vulnerability |
| CVE-2024-35669 | WordPress Debug Log Manager plugin <= 2.3.1 - Broken Access Control vulnerability |
| CVE-2024-35671 | WordPress MJ Update History plugin <= 1.0.4 - Broken Access Control vulnerability |
| CVE-2024-35672 | WordPress Netgsm plugin <= 2.9.19 - Broken Access Control vulnerability |
| CVE-2024-35674 | WordPress Unlimited Elements For Elementor plugin <= 1.5.109 - Broken Access Control vulnerability |
| CVE-2024-35683 | WordPress Leyka plugin <= 3.31.1 - Broken Access Control vulnerability |
| CVE-2024-35685 | WordPress Radcliffe 2 theme <= 2.0.17 - Broken Access Control vulnerability |
| CVE-2024-35686 | WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerability |
| CVE-2024-35692 | WordPress GDPR/CCPA Cookie Consent Banner plugin <= 3.2 - Broken Access Control vulnerability |
| CVE-2024-35716 | WordPress Copymatic plugin <= 1.9 - Broken Access Control vulnerability |
| CVE-2024-35717 | WordPress Media Slider plugin <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2024-35720 | WordPress Album Gallery – WordPress Gallery plugin <= 1.5.7 - Broken Access Control vulnerability |
| CVE-2024-35721 | WordPress Image Gallery plugin <= 1.4.5 - Broken Access Control vulnerability |
| CVE-2024-35722 | WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2024-35723 | WordPress Dashboard To-Do List plugin <= 1.2.0 - Broken Access Control vulnerability |
| CVE-2024-35724 | WordPress Bosa Elementor Addons and Templates for WooCommerce plugin <= 1.0.12 - Broken Access Control vulnerability |
| CVE-2024-35725 | WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.6 - Broken Access Control vulnerability |
| CVE-2024-35726 | WordPress WooBuddy plugin <= 3.4.19 - Broken Access Control vulnerability |
| CVE-2024-35727 | WordPress Extra Product Options for WooCommerce plugin <= 3.0.6 - Broken Access Control vulnerability |
| CVE-2024-35729 | WordPress Tickera plugin <= 3.5.2.6 - Broken Access Control vulnerability |
| CVE-2024-35735 | WordPress WP Time Slots Booking Form plugin <= 1.2.11 - Broken Access Control vulnerability |
| CVE-2024-35741 | WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability |
| CVE-2024-35742 | WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Broken Access Control vulnerability |
| CVE-2024-35748 | WordPress WooCommerce Dropshipping plugin <= 5.0.4 - Unauthenticated Arbitrary Email Sending vulnerability |
| CVE-2024-3581 | MaxGalleria <= 6.4.2 - Missing Authorization |
| CVE-2024-3585 | Send PDF for Contact Form 7 <= 1.0.2.3 - Missing Authorization |
| CVE-2024-3599 | WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion |
| CVE-2024-3600 | Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting |
| CVE-2024-3601 | Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration |
| CVE-2024-3602 | Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer <= 1.1.0 - Missing Authoriz... |
| CVE-2024-3606 | ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization |
| CVE-2024-3607 | PropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion |
| CVE-2024-3608 | Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion |
| CVE-2024-3609 | ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.27 - Missing Authorization |
| CVE-2024-3610 | WP Child Theme Generator <= 1.1.1 - Missing Authorization to Unauthenticated Child Theme Creation/Activation |
| CVE-2024-36113 | Discourse missing authorization checks for suspending admins/moderators |
| CVE-2024-36246 | Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code ma... |
| CVE-2024-3626 | Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missi... |
| CVE-2024-3627 | Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints |
| CVE-2024-36326 | Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a stan... |
| CVE-2024-3662 | WPZOOM Social Feed Widget & Block <= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion |
| CVE-2024-3663 | WP Scraper <= 5.7 - Missing Authorization to Arbitrary Page/Post Creation |
| CVE-2024-3664 | Quick Featured Images <= 13.7.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Setting |
| CVE-2024-3678 | Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure |
| CVE-2024-36995 | Low-privileged user could create experimental items |
| CVE-2024-37094 | WordPress MasterStudy LMS plugin <= 3.2.12 - Broken Access Control vulnerability |
| CVE-2024-37095 | WordPress Envira Photo Gallery plugin <= 1.8.7.3 - CSRF leading to notice dismissal vulnerability |
| CVE-2024-37096 | WordPress Popup box plugin <= 4.5.1 - Broken Access Control vulnerability |
| CVE-2024-37106 | WordPress WishList Member X plugin < 3.26.7 - Unautenticated Plugin Settings Change Leading to Stored XSS vulnerability |
| CVE-2024-3711 | Brizy – Page Builder <= 2.4.43 - Missing Authorization |
| CVE-2024-37111 | WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Denial of Service Attack vulnerability |
| CVE-2024-37119 | WordPress Uncanny Automator Pro plugin < 5.3.0.1 - Unauthenticated License Settings Reset vulnerability |
| CVE-2024-37123 | WordPress Ibtana – WordPress Website Builder plugin <= 1.2.3.3 - Broken Access Control vulnerability |
| CVE-2024-37172 | [CVE-2024-37172] Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management) |
| CVE-2024-37175 | [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI) |
| CVE-2024-37176 | Missing Authorization check in SAP BW/4HANA Transformation and DTP |
| CVE-2024-37201 | WordPress Woocommerce Customers Order History plugin <= 5.2.2 - Broken Access Control vulnerability |
| CVE-2024-37202 | WordPress Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter plugin <= 1.222.17 - Broken Access Co... |
| CVE-2024-37203 | WordPress Laybuy Payment Extension for WooCommerce plugin <= 5.3.9 - Broken Access Control vulnerability |
| CVE-2024-37204 | WordPress PropertyHive plugin <= 2.0.9 - Broken Access Control vulnerability |
| CVE-2024-37207 | WordPress Demo Awesome plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2024-37209 | WordPress User Rights Access Manager plugin <= 1.1.2 - Broken Access Control vulnerability |
| CVE-2024-37210 | WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control vulnerability |
| CVE-2024-37214 | WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control to XSS vulnerability |
| CVE-2024-37218 | WordPress Page Builder Sandwich <= 5.1.0 - Broken Access Control vulnerability |
| CVE-2024-37220 | WordPress Optinly plugin <= 1.0.18 - Broken Access Control vulnerability |
| CVE-2024-37226 | WordPress Kanban Boards for WordPress plugin <= 2.5.21 - Broken Access Control vulnerability |
| CVE-2024-37232 | WordPress Hercules Core plugin <= 6.5 - Subscriber+ Arbitrary Settings Change/Access vulnerability |
| CVE-2024-37249 | WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerability |
| CVE-2024-37250 | WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Subscriber+ Broken Access Control vulnerability |
| CVE-2024-37254 | WordPress WP File Manager plugin <= 7.2.7 - Broken Access Control vulnerability |
| CVE-2024-37255 | WordPress ElementsKit Lite plugin <= 3.1.4 - Unauthenticated Broken Access Control vulnerability |
| CVE-2024-37269 | WordPress Masterstudy Elementor Widgets plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerability |
| CVE-2024-37276 | WordPress Featured Image from URL (FIFU) plugin <= 4.8.1 - Broken Access Control vulnerability |
| CVE-2024-37296 | Aimeos HTML client vulnerable to digital products download without proper payment status check |
| CVE-2024-37363 | Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization |
| CVE-2024-37411 | WordPress Progress Planner plugin <= 0.9.1 - Broken Access Control vulnerability |
| CVE-2024-37415 | WordPress E2Pdf plugin <= 1.20.27 - Broken Access Control vulnerability |
| CVE-2024-37425 | WordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerability |
| CVE-2024-37427 | WordPress Timetics plugin <= 1.0.21 - Broken Access Control vulnerability |
| CVE-2024-37439 | WordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Subscriber+ Arbitrary Post/Page Duplication vulnerability |
| CVE-2024-37440 | WordPress Church Admin plugin <= 4.4.4 - Broken Access Control vulnerability |
| CVE-2024-37443 | WordPress WP Job Manager plugin <= 2.1.0 - Broken Access Control vulnerability |
| CVE-2024-37444 | WordPress Defender plugin <= 4.7.1 - Broken Access Control vulnerability |
| CVE-2024-37453 | WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 5.8.7 - Broken Access Control vulnerability |
| CVE-2024-37456 | WordPress Simple Newsletter Plugin – Noptin plugin <= 3.4.2 - Broken Access Control vulnerability |
| CVE-2024-37463 | WordPress CRM Perks Forms plugin <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2024-37468 | WordPress Newsmatic theme <= 1.3.1 - Broken Access Control vulnerability |
| CVE-2024-37470 | WordPress Woffice Core plugin <= 5.4.8 - Unauthenticated Broken Access Control vulnerability |
| CVE-2024-37475 | WordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerability |
| CVE-2024-37477 | WordPress Newspack Content Converter plugin <= 0.1.5 - Broken Access Control vulnerability |
| CVE-2024-37481 | WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability |
| CVE-2024-37482 | WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability |
| CVE-2024-37483 | WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability |
| CVE-2024-37496 | WordPress Metro Magazine theme <= 1.3.7 - Broken Access Control on Notice Dismissal vulnerability |
| CVE-2024-3750 | Visualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL Execution |
| CVE-2024-37505 | WordPress Business One Page theme <= 1.2.9 - Broken Access Control on Notice Dismissal vulnerability |
| CVE-2024-37506 | WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability |
| CVE-2024-37510 | WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability |
| CVE-2024-37516 | WordPress Featured Image from URL (FIFU) plugin <= 4.8.2 - Broken Access Control vulnerability |
| CVE-2024-37517 | WordPress Spectra plugin <= 2.13.7 - Broken Access Control vulnerability |
| CVE-2024-37542 | WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2024-37544 | WordPress Get Better Reviews for WooCommerce plugin <= 4.0.6 - Broken Access Control vulnerability |
| CVE-2024-3761 | Missing Authorization on Delete Datasets in lunary-ai/lunary |
| CVE-2024-37898 | XWiki Platform vulnerable to document deletion and overwrite from edit |
| CVE-2024-37901 | XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet |
| CVE-2024-37903 | Mastodon has improper authorship check on audience extension for existing posts |
| CVE-2024-37921 | WordPress Chained Quiz plugin <= 1.3.2.8 - Broken Access Control vulnerability |
| CVE-2024-37926 | WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.9 - Broken Access Control vulnerability |
| CVE-2024-37929 | WordPress User Activity Log Pro plugin <= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerability |
| CVE-2024-37930 | WordPress SmartMag theme < 10.1.0 - Sensitive Data Exposure via Log File vulnerability |
| CVE-2024-37935 | WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Sensitive Data Exposure vulnerability |
| CVE-2024-38002 | The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 thro... |
| CVE-2024-38179 | Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability |
| CVE-2024-38190 | Power Platform Information Disclosure Vulnerability |
| CVE-2024-3821 | wpDataTables - Tables & Table Charts (Premium) <= 6.3.2 - Missing Authorization to DataTable Access & Modification |
| CVE-2024-38353 | CodiMD - Missing Image Access Controls and Unauthorized Image Access |
| CVE-2024-3869 | Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search |
| CVE-2024-38690 | WordPress iPanorama 360 plugin <= 1.8.3 - Broken Access Control vulnerability |
| CVE-2024-38695 | WordPress WP GoToWebinar plugin <= 15.6 - Broken Access Control vulnerability |
| CVE-2024-38699 | WordPress Wallet System for WooCommerce plugin <= 2.5.13 - Sensitive Data Exposure via Exported File vulnerability |
| CVE-2024-38702 | WordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.2 - Broken Access Control vulnerability |
| CVE-2024-38707 | WordPress EmbedPress plugin <= 4.0.4 - Broken Access Control vulnerability |
| CVE-2024-38714 | WordPress WP Fast Total Search <= 1.68.232 - Broken Access Control vulnerability |
| CVE-2024-38719 | WordPress Auto Featured Image plugin <= 4.1.2 - Broken Access Control vulnerability |
| CVE-2024-38721 | WordPress EazyDocs plugin <= 2.5.0 - Broken Access Control vulnerability |
| CVE-2024-38726 | WordPress Product Designer plugin <= 1.0.33 - Arbitrary Content Deletion vulnerability |
| CVE-2024-38727 | WordPress Seraphinite Post .DOCX Source plugin <= 2.16.9 - Broken Access Control vulnerability |
| CVE-2024-38733 | WordPress Meks Video Importer plugin <= 1.0.12 - Broken Access Control vulnerability |
| CVE-2024-38737 | WordPress ReDi Restaurant Reservation plugin <= 24.0422 - Broken Access Control vulnerability |
| CVE-2024-38740 | WordPress Packlink PRO shipping module plugin <= 3.4.6 - Broken Access Control vulnerability |
| CVE-2024-38743 | WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control vulnerability |
| CVE-2024-38744 | WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control to Unauth Stored XSS vulnerability |
| CVE-2024-38745 | WordPress Wholesale Suite plugin <= 2.1.12 - Broken Access Control vulnerability |
| CVE-2024-38748 | WordPress EleForms plugin <= 2.9.9.9 - Broken Access Control vulnerability |
| CVE-2024-38769 | WordPress Arconix Shortcodes plugin <= 2.1.11 - Broken Access Control vulnerability |
| CVE-2024-38771 | WordPress Atarim plugin <= 4.0 - Broken Access Control vulnerability |
| CVE-2024-38774 | WordPress Security Optimizer plugin <= 1.5.0 - Broken Access Control vulnerability |
| CVE-2024-38777 | WordPress Titan Anti-spam & Security plugin <= 7.3.6 - Broken Access Control vulnerability |
| CVE-2024-38783 | WordPress Arconix FAQ plugin <= 1.9.4 - Broken Access Control vulnerability |
| CVE-2024-38792 | WordPress ConveyThis Translate plugin <= 234 - Non-arbitrary Options Update vulnerability |
| CVE-2024-38794 | WordPress Custom Query Blocks plugin <= 5.2.0 - Broken Access Control vulnerability |
| CVE-2024-3893 | Classified Listing – Classified ads & Business Directory Plugin <= 3.0.10.3 - Missing Authorization to Authenticated (Subscri... |
| CVE-2024-3895 | WP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2024-3897 | Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure |
| CVE-2024-3915 | Swift Framework <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update |
| CVE-2024-3932 | Totara LMS User Selector cross-site request forgery |
| CVE-2024-3936 | The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization |
| CVE-2024-3942 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization |
| CVE-2024-39546 | Junos OS Evolved: Local low-privilege user can gain root permissions leading to privilege escalation |
| CVE-2024-39591 | Missing Authorization check in SAP Document Builder |
| CVE-2024-39592 | [CVE-2024-39592] Missing Authorization check in SAP PDCE |
| CVE-2024-39596 | [CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable Now |
| CVE-2024-3961 | ConvertKit <= 2.4.9 - Missing Authorization |
| CVE-2024-39625 | WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Message Duplication Vulnerability |
| CVE-2024-39635 | WordPress Youzify plugin <= 1.2.6 - Broken Access Control vulnerability |
| CVE-2024-39640 | WordPress Social Feed Gallery plugin <= 4.3.9 - Broken Access Control vulnerability |
| CVE-2024-39650 | WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Multiple Vulnerabilities |
| CVE-2024-39654 | WordPress Sign-up Sheets plugin <= 2.2.12 - Broken Access Control vulnerability |
| CVE-2024-39664 | WordPress Filter & Grids plugin <= 2.8.32 - Broken Authentication vulnerability |
| CVE-2024-3976 | Missing Authorization in GitLab |
| CVE-2024-39823 | Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Missing Authorization |
| CVE-2024-39824 | Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Missing Authorization |
| CVE-2024-4010 | Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request |
| CVE-2024-4088 | Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.2 - Missing Authorization |
| CVE-2024-4102 | Pricing Table <= 2.0.1 - Missing Authorization |
| CVE-2024-4138 | Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules) |
| CVE-2024-4139 | Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules) |
| CVE-2024-41728 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform |
| CVE-2024-41729 | Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer) |
| CVE-2024-41730 | Missing Authentication check in SAP BusinessObjects Business Intelligence Platform |
| CVE-2024-41734 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform |
| CVE-2024-4199 | Bulk Posts Editing For WordPress <= 4.2.3 - Authenticated (Subscriber+) Missing Authorization |
| CVE-2024-42035 | Permission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect... |
| CVE-2024-4205 | Premium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosure |
| CVE-2024-4222 | Tutor LMS Pro <= 2.7.0 - Missing Authorization |
| CVE-2024-4223 | Tutor LMS <= 2.7.0 - Missing Authorization |
| CVE-2024-4233 | Broken Access Control vulnerability in multiple WordPress plugins by Tyche Softwares |
| CVE-2024-42371 | Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform |
| CVE-2024-42372 | Missing Authorization check in SAP NetWeaver AS Java (System Landscape Directory) |
| CVE-2024-42373 | Missing Authorization Check in SAP Student Life Cycle Management (SLcM) |
| CVE-2024-42376 | Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework |
| CVE-2024-42377 | Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework |
| CVE-2024-42380 | Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform |
| CVE-2024-42434 | Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Missing Authorization |
| CVE-2024-42470 | CometVisu Backend for openHAB has a sensitive information disclosure vulnerability |
| CVE-2024-4259 | Sensetive Data Exposure in SAMPAS's AKOS |
| CVE-2024-4280 | White Label CMS <= 2.7.3 - Missing Authorization to Plugin Settings Reset |
| CVE-2024-43118 | WordPress Hummingbird plugin <= 3.9.1 - Broken Access Control vulnerability |
| CVE-2024-43119 | WordPress Aruba HiSpeed Cache plugin <= 2.0.12 - Broken Access Control vulnerability |
| CVE-2024-43120 | WordPress TypeSquare Webfonts plugin <= 2.0.7 - Broken Access Control vulnerability |
| CVE-2024-43122 | WordPress Robin image optimizer plugin <= 1.6.9 - Broken Access Control vulnerability |
| CVE-2024-43134 | WordPress Waitlist Woocommerce plugin <= 2.6 - Broken Access Control vulnerability |
| CVE-2024-43136 | WordPress Sunshine Photo Cart plugin <= 3.2.1 - Broken Access Control vulnerability |
| CVE-2024-43142 | WordPress Tutor LMS plugin <= 2.7.3 - Broken Access Control vulnerability |
| CVE-2024-43143 | WordPress Registrations for the Events Calendar plugin <= 2.12.1 - Broken Access Control vulnerability |
| CVE-2024-43146 | WordPress Accelerated Mobile Pages plugin <= 1.0.96.1 - Broken Access Control vulnerability |
| CVE-2024-43154 | WordPress Advanced Cron Manager – debug & control plugin <= 2.5.9 - Broken Access Control vulnerability |
| CVE-2024-43157 | WordPress FormCraft plugin <= 1.2.10 - Broken Access Control vulnerability |
| CVE-2024-43158 | WordPress Masteriyo LMS plugin <= 1.11.4 - Broken Access Control vulnerability |
| CVE-2024-43159 | WordPress Masteriyo LMS plugin <= 1.11.6 - Broken Access Control vulnerability |
| CVE-2024-43162 | WordPress Easy Digital Downloads plugin <= 3.2.12 - Broken Access Control vulnerability |
| CVE-2024-4317 | PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks |
| CVE-2024-4319 | Advanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure |
| CVE-2024-43208 | WordPress Send Emails with Mandrill plugin <= 1.4.1 - Broken Access Control vulnerability |
| CVE-2024-43209 | WordPress Bitly's WordPress Plugin plugin <= 2.7.2 - Broken Access Control vulnerability |
| CVE-2024-43212 | WordPress WpTravelly plugin <= 1.7.7 - Broken Access Control vulnerability |
| CVE-2024-43214 | WordPress myCred plugin <= 2.7.2 - Sensitive Data Exposure vulnerability |
| CVE-2024-43215 | WordPress Social Slider Feed plugin <= 2.2.2 - Broken Access Control vulnerability |
| CVE-2024-43219 | WordPress Persian WooCommerce plugin <= 7.1.6 - Broken Access Control vulnerability |
| CVE-2024-43222 | WordPress Sweet Date theme <= 3.7.3 - Privilege Escalation vulnerability |
| CVE-2024-43223 | WordPress EventPrime plugin <= 4.0.3.2 - Broken Access Control vulnerability |
| CVE-2024-43228 | WordPress SecuPress Free plugin <= 2.2.5.3 - Broken Access Control vulnerability |
| CVE-2024-43229 | WordPress WP Search Analytics plugin <= 1.4.9 - Broken Access Control vulnerability |
| CVE-2024-43235 | WordPress Meta Box plugin <= 5.9.10 - Broken Access Control vulnerability |
| CVE-2024-43247 | WordPress WHMpress plugin <= 6.2-revision-5 - Subscriber+ Arbitrary Settings Change vulnerability |
| CVE-2024-43253 | WordPress Smart Online Order for Clover plugin <= 1.5.6 - Broken Access Control vulnerability |
| CVE-2024-43254 | WordPress Smart Online Order for Clover plugin <= 1.5.6 - Broken Access Control vulnerability |
| CVE-2024-43256 | WordPress Leopard plugin <= 2.0.36 - Subscriber+ Plugin Settings Change vulnerability |
| CVE-2024-43260 | WordPress Clearfy Cache plugin <= 2.2.4 - Broken Access Control vulnerability |
| CVE-2024-43268 | WordPress Backup and Restore WordPress plugin <= 1.50 - Broken Access Control vulnerability |
| CVE-2024-43270 | WordPress Backup and Restore WordPress plugin <= 1.50 - Unauthenticated Broken Access Control vulnerability |
| CVE-2024-43273 | WordPress Icegram Collect plugin <= 1.3.14 - Broken Access Control vulnerability |
| CVE-2024-43274 | WordPress JS Help Desk – The Ultimate Help Desk plugin <= 2.8.6 - Broken Access Control vulnerability |
| CVE-2024-43277 | WordPress UsersWP plugin <= 1.2.15 - Broken Access Control vulnerability |
| CVE-2024-43285 | WordPress Presto Player plugin <= 3.0.2 - Broken Access Control vulnerability |
| CVE-2024-43290 | WordPress Atarim plugin <= 4.0.1 - Broken Access Control vulnerability |
| CVE-2024-43293 | WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.3.1 - Broken Access Control vulnerability |
| CVE-2024-43296 | WordPress HTML5 Video Player plugin <= 2.5.30 - Broken Access Control vulnerability |
| CVE-2024-43297 | WordPress Clone plugin <= 2.4.5 - Broken Access Control vulnerability |
| CVE-2024-43298 | WordPress Clone plugin <= 2.4.5 - Broken Access Control vulnerability |
| CVE-2024-43302 | WordPress Fonts plugin <= 3.7.7 - Broken Access Control vulnerability |
| CVE-2024-43310 | WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.9 - Broke... |
| CVE-2024-43312 | WordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.1.9 - Broken Access Control vulnerability |
| CVE-2024-43314 | WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.9.3 - Broken Access Control vulnerability |
| CVE-2024-43323 | WordPress ReviewX plugin <= 1.6.28 - Broken Access Control vulnerability |
| CVE-2024-43326 | WordPress Plugin Notes Plus plugin <= 1.2.7 - Arbitrary Content Deletion vulnerability |
| CVE-2024-43331 | WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerability |
| CVE-2024-43332 | WordPress Photo Engine plugin <= 6.4.0 - Broken Access Control vulnerability |
| CVE-2024-43341 | WordPress Hello Agency theme <= 1.0.5 - Broken Access Control vulnerability |
| CVE-2024-43343 | WordPress Order Tracking – WordPress Status Tracking Plugin plugin < 3.3.13 - Broken Access Control vulnerability |
| CVE-2024-43355 | WordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerability |
| CVE-2024-4341 | IDOR in ExtremePacs's Extreme XDS |
| CVE-2024-4352 | Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection |
| CVE-2024-4355 | Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 10.23 - Missing Authorization to Informatio... |
| CVE-2024-43662 | Authenticated arbitrary file upload to /tmp/ and /tmp/upload/ |
| CVE-2024-43919 | WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability |
| CVE-2024-43923 | WordPress Timetics plugin <= 1.0.23 - Broken Access Control vulnerability |
| CVE-2024-43924 | WordPress Responsive Lightbox & Gallery plugin <= 2.4.7 - Broken Access Control vulnerability |
| CVE-2024-43925 | WordPress Envira Gallery Lite plugin <= 1.8.14 - Broken Access Control vulnerability |
| CVE-2024-43928 | WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability |
| CVE-2024-43929 | WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability |
| CVE-2024-43932 | WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Broken Access Control vulnerability |
| CVE-2024-43937 | WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability |
| CVE-2024-43939 | WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Arbitrary Option Deletion vulnerability |
| CVE-2024-43940 | WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Plugin Settings Change vulnerability |
| CVE-2024-43956 | WordPress MemberPress plugin <= 1.11.34 - Broken Access Control vulnerability |
| CVE-2024-43962 | WordPress LWS Affiliation plugin <= 2.3.4 - Broken Access Control vulnerability |
| CVE-2024-43968 | WordPress Newspack plugin < 3.8.7 - Broken Access Control vulnerability |
| CVE-2024-43973 | WordPress GetPaid plugin <= 2.8.11 - Broken Access Control vulnerability |
| CVE-2024-43974 | WordPress ReviveNews theme <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2024-43979 | WordPress Blockbooster theme <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2024-43980 | WordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerability |
| CVE-2024-43981 | WordPress GeoDirectory plugin <= 2.3.70 - Broken Access Control vulnerability |
| CVE-2024-43982 | WordPress Login As Users plugin <= 1.4.3 - Broken Access Control to Account Takeover vulnerability |
| CVE-2024-43998 | WordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerability |
| CVE-2024-44006 | WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.7 - Broken Access Control vulnerability |
| CVE-2024-44019 | WordPress Contact Form 7 Campaign Monitor Extension plugin <= 0.4.67 - Arbitrary File Deletion vulnerability |
| CVE-2024-44020 | WordPress WP Free SSL plugin <= 1.2.6 - Broken Access Control vulnerability |
| CVE-2024-44021 | WordPress Truepush plugin <= 1.0.8 - Broken Access Control vulnerability |
| CVE-2024-44031 | WordPress JoomSport plugin <= 5.6.3 - Broken Access Control vulnerability |
| CVE-2024-44038 | WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability |
| CVE-2024-44052 | WordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerability |
| CVE-2024-4410 | IgnitionDeck Crowdfunding Platform <= 1.9.8 - Missing Authorization |
| CVE-2024-44112 | Missing Authorization check in SAP for Oil & Gas (Transportation and Distribution) |
| CVE-2024-44113 | Information Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer) |
| CVE-2024-44115 | Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform |
| CVE-2024-44116 | Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform |
| CVE-2024-44117 | Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform |
| CVE-2024-4422 | Comparison Slider <= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting |
| CVE-2024-4427 | Comparison Slider <= 1.0.5 - Missing Authorization |
| CVE-2024-4428 | Sensetive Data Exposure in Menulux Managment Portal |
| CVE-2024-4445 | WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Missing Authorization |
| CVE-2024-4450 | AliExpress Dropshipping with AliNext Lite <= 3.3.6 - Missing Authorization via Several Functions |
| CVE-2024-45050 | Ringer Server Does Not Check Members When Loading Messages |
| CVE-2024-4520 | Improper Access Control in gaizhenbiao/chuanhuchatgpt |
| CVE-2024-45284 | Missing authorization check in SAP Student Life Cycle Management (SLcM) |
| CVE-2024-45285 | Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform |
| CVE-2024-45286 | Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface) |
| CVE-2024-45307 | SudoBot missing authorization check in `-config` command |
| CVE-2024-45393 | Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries |
| CVE-2024-45461 | Apache CloudStack Quota plugin: Access checks not enforced in Quota |
| CVE-2024-45591 | XWiki Platform document history including authors of any page exposed to unauthorized actors |
| CVE-2024-4566 | ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification |
| CVE-2024-45732 | Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app |
| CVE-2024-45760 | Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper access control vulnerability. A remot... |
| CVE-2024-4660 | Missing Authorization in GitLab |
| CVE-2024-4661 | WP Reset <= 2.02 - Missing Authorization to License Key Modification |
| CVE-2024-47055 | Segment cloning doesn't have a proper permission check |
| CVE-2024-47268 | Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-957... |
| CVE-2024-47302 | WordPress Fluent Support plugin <= 1.8.0 - Broken Access Control on Email Verification vulnerability |
| CVE-2024-47308 | WordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerability |
| CVE-2024-47311 | WordPress Wheel of Life plugin <= 1.1.8 - Broken Access Control vulnerability |
| CVE-2024-47314 | WordPress Sunshine Photo Cart plugin <= 3.2.8 - Broken Access Control vulnerability |
| CVE-2024-47317 | WordPress Ads by WPQuads plugin <= 2.0.84 - Broken Access Control vulnerability |
| CVE-2024-47318 | WordPress PWA for WP & AMP plugin <= 1.7.72 - Broken Access Control vulnerability |
| CVE-2024-47321 | WordPress WP Datepicker plugin <= 2.1.1 - Broken Access Control vulnerability |
| CVE-2024-47330 | Broken Access Control vulnerability on multiple WordPress plugins by Supsystic |
| CVE-2024-47337 | WordPress Joy Of Text Lite plugin <= 2.3.1 - Broken Access Control vulnerability |
| CVE-2024-47358 | WordPress Popup Maker plugin <= 1.19.2 - Broken Access Control vulnerability |
| CVE-2024-47359 | WordPress Depicter plugin <= 3.2.2 - Broken Access Control vulnerability |
| CVE-2024-47361 | WordPress Elementor Addon Elements plugin <= 1.13.6 - Broken Access Control vulnerability |
| CVE-2024-47362 | WordPress Strong Testimonials plugin <= 3.1.16 - Broken Access Control vulnerability |
| CVE-2024-4744 | WordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerability |
| CVE-2024-4745 | WordPress Giveaways and Contests by RafflePress plugin <= 1.12.4 - Broken Access Control vulnerability |
| CVE-2024-4746 | WordPress Netgsm plugin <= 2.9.32 - Broken Access Control + CSRF vulnerability |
| CVE-2024-47581 | Missing Authorization check in SAP HCM (Approve Timesheets version 4) |
| CVE-2024-47585 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform |
| CVE-2024-47587 | Missing authorization check in SAP Cash Management (Cash Operations) |
| CVE-2024-47790 | Missing Authorization Vulnerability |
| CVE-2024-4788 | Boostify Header Footer Builder for Elementor <= 1.3.5 - Missing Authorization to Page/Post Creation |
| CVE-2024-48039 | WordPress CubeWP Framework plugin <= 1.1.15 - Broken Access Control vulnerability |
| CVE-2024-48044 | WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - Broken Access Control vulnerability |
| CVE-2024-48045 | WordPress Happy Elementor Addons plugin <= 3.12.3 - Broken Access Control vulnerability |
| CVE-2024-4858 | Testimonial Carousel For Elementor <= 10.2.0 - Missing Authorization to Limited Setting Update |
| CVE-2024-4875 | HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update |
| CVE-2024-4888 | Arbitrary File Deletion in BerriAI/litellm |
| CVE-2024-48898 | Moodle: some users can delete audiences of other reports |
| CVE-2024-4898 | InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary O... |
| CVE-2024-49273 | WordPress ProfileGrid plugin <= 5.9.3 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-49293 | WordPress WP VR plugin <= 8.5.4 - Broken Access Control vulnerability |
| CVE-2024-49321 | WordPress Simple Custom Post Order plugin <= 2.5.7 - Broken Access Control vulnerability |
| CVE-2024-49325 | WordPress Photo Gallery Builder plugin <= 3.0 - Broken Access Control to Notice Dismissal vulnerability |
| CVE-2024-49367 | Nginx UI's log path can be controlled |
| CVE-2024-4958 | User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorizatio... |
| CVE-2024-49581 | Access control issue impacting RV backed objects |
| CVE-2024-49596 | Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability. A high privileged attac... |
| CVE-2024-49657 | WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Deletion vulnerability |
| CVE-2024-49680 | WordPress WP VR plugin <= 8.5.5 - Broken Access Control vulnerability |
| CVE-2024-49683 | WordPress Schema & Structured Data for WP & AMP plugin <= 1.3.5 - Sensitive Data Exposure vulnerability |
| CVE-2024-49686 | WordPress Landing Page Cat plugin <= 1.7.4 - Broken Access Control vulnerability |
| CVE-2024-49687 | WordPress Smart Manager plugin <= 8.45.0 - Broken Access Control vulnerability |
| CVE-2024-49689 | WordPress HD Quiz – Save Results Light plugin <= 0.5 - Broken Access Control vulnerability |
| CVE-2024-49694 | WordPress My Wp Brand – Hide menu & Hide Plugin plugin <= 1.1.2 - Broken Access Control vulnerability |
| CVE-2024-49697 | WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability |
| CVE-2024-49698 | WordPress Great Restaurant Menu WP plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2024-4997 | WPUpper Share Buttons <= 3.43 - Missing Authorization |
| CVE-2024-50052 | Arbitrary post deletion via Playbooks /ignore-thread endpoint |
| CVE-2024-50417 | WordPress Bold Page Builder plugin <= 5.1.3 - Broken Access Control vulnerability |
| CVE-2024-50421 | WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 3.8.6 - Broken Access Control vulnerability |
| CVE-2024-50422 | WordPress Breeze plugin <= 2.1.14 - Broken Access Control vulnerability |
| CVE-2024-50423 | WordPress Templately plugin <= 3.1.5 - Broken Access Control vulnerability |
| CVE-2024-50424 | WordPress Templately plugin <= 3.1.5 - Broken Access Control vulnerability |
| CVE-2024-50428 | WordPress Multi Step Form plugin <= 1.7.21 - Broken Access Control vulnerability |
| CVE-2024-50454 | WordPress SEOPress plugin <= 8.1.1 - Unauthenticated Broken Access Control vulnerability |
| CVE-2024-50455 | WordPress SEOPress plugin <= 8.1.1 - Broken Access Control vulnerability |
| CVE-2024-50456 | WordPress SEOPress plugin <= 8.1.1 - Broken Access Control vulnerability |
| CVE-2024-50459 | WordPress AidWP plugin <= 3.2.3 - Broken Access Control vulnerability |
| CVE-2024-50475 | WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2024-50476 | WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2024-50490 | WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2024-50500 | WordPress Phlox Core Elements plugin <= 2.17.4 - Broken Access Control vulnerability |
| CVE-2024-5087 | Minimal Coming Soon – Coming Soon Page <= 2.38 - Missing Authorization to Limited Settings Change |
| CVE-2024-5126 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-5127 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-5129 | Privilege Escalation Vulnerability in lunary-ai/lunary |
| CVE-2024-5130 | Incorrect Authorization in lunary-ai/lunary |
| CVE-2024-51516 | Permission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause featur... |
| CVE-2024-51651 | WordPress CubeWP Forms plugin <= 1.1.10 - Broken Access Control vulnerability |
| CVE-2024-51660 | WordPress Easy Accordion Gutenberg Block plugin <= 1.2.3 - Broken Access Control vulnerability |
| CVE-2024-51666 | WordPress Tours plugin <= 1.0.0 - Broken Access Control vulnerability |
| CVE-2024-51667 | WordPress paytium plugin <= 4.4.10 - Broken Access Control vulnerability |
| CVE-2024-51671 | WordPress Otter Blocks plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2024-51817 | WordPress Combo WP Rewrite Slugs plugin <= 1.0 - Settings Change vulnerability |
| CVE-2024-52382 | WordPress Matix Popup Builder plugin <= 1.0.0 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2024-52383 | WordPress Ai Auto Tool Content Writing Assistant plugin <= 2.1.2 - Broken Access Control vulnerability |
| CVE-2024-52391 | WordPress Pie Register Premium plugin < 3.8.3.3 - Broken Access Control vulnerability |
| CVE-2024-52395 | WordPress Floating Buttons for WooCommerce plugin <= 2.8.8 - Broken Access Control vulnerability |
| CVE-2024-52416 | WordPress Debug Tool plugin <= 2.2 - Remote Code Execution vulnerability |
| CVE-2024-5248 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-52480 | WordPress Jobify plugin < 4.3.0 - Broken Access Control vulnerability |
| CVE-2024-52485 | WordPress WP Menu Image plugin <= 2.2 - Broken Access Control vulnerability |
| CVE-2024-52500 | WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2024-5309 | Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions |
| CVE-2024-5318 | Missing Authorization in GitLab |
| CVE-2024-5324 | XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update |
| CVE-2024-53258 | download_all_submissions allows student to download another student's submissions in Autolab |
| CVE-2024-5326 | Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update |
| CVE-2024-53298 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.1, contains a missing authorization vulnerability in the NFS export. A... |
| CVE-2024-53708 | WordPress AI Quiz plugin <= 1.1 - Broken Access Control vulnerability |
| CVE-2024-53784 | WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.0.4 - Broken Access Control vulnerability |
| CVE-2024-53785 | WordPress Chatter plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2024-53795 | WordPress Church Admin plugin <= 5.0.8 - Broken Access Control vulnerability |
| CVE-2024-53798 | WordPress FloristPress plugin <= 7.3.0 - Nonce Leakage to Broken Access Control vulnerability |
| CVE-2024-53799 | WordPress FloristPress plugin <= 7.3.0 - Broken Access Control vulnerability |
| CVE-2024-53803 | WordPress WP Mailster plugin <= 1.8.16.0 - Broken Access Control vulnerability |
| CVE-2024-53805 | WordPress WP Mailster plugin <= 1.8.16.0 - Broken Access Control vulnerability |
| CVE-2024-53806 | WordPress Maspik plugin <= 2.2.7 - CSRF to Settings Change vulnerability |
| CVE-2024-53810 | WordPress Simple User Registration plugin <= 5.5 - Broken Access Control on User Deletion vulnerability |
| CVE-2024-53813 | WordPress WP Travel plugin <= 9.6.0 - Broken Access Control vulnerability |
| CVE-2024-53816 | WordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerability |
| CVE-2024-53819 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-5382 | Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization... |
| CVE-2024-53825 | WordPress FileBird Lite plugin <= 6.3.2 - Broken Access Control vulnerability |
| CVE-2024-53826 | WordPress WPCasa plugin <= 1.2.13 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-54020 | A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an... |
| CVE-2024-54217 | WordPress ARForms plugin <= 6.4.1 - Subscriber+ Plugin Settings Change vulnerability |
| CVE-2024-54218 | WordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Plugin Settings Change vulnerability |
| CVE-2024-54222 | WordPress Seraphinite Accelerator plugin <= 2.22.15 - Authenticated Sensitive Data Exposure vulnerability |
| CVE-2024-54227 | WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2024-54239 | WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2024-54241 | WordPress Elite Notification plugin 1.5 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-54242 | WordPress Simple Notification plugin <= 1.3 - Broken Access Control vulnerability |
| CVE-2024-54251 | WordPress Prodigy Commerce plugin <= 3.1.2 - Broken Access Control vulnerability |
| CVE-2024-54252 | WordPress Pinpoint Booking System Plugin <= 2.9.9.5.7 - Broken Access Control vulnerability |
| CVE-2024-54254 | WordPress Message Filter for Contact Form 7 plugin <= 1.6.3 - Broken Access Control vulnerability |
| CVE-2024-54256 | WordPress Easy Blocks pro plugin <= 1.0.21 - Broken Access Control vulnerability |
| CVE-2024-54267 | WordPress CM Answers plugin <= 3.2.6 - Broken Access Control vulnerability |
| CVE-2024-54268 | WordPress SiteOrigin Widgets Bundle plugin <= 1.64.0 - Broken Access Control vulnerability |
| CVE-2024-54269 | WordPress Notibar plugin <= 2.1.4 - Broken Access Control vulnerability |
| CVE-2024-54271 | WordPress WPCargo Track & Trace plugin <= 8.0.2 - Settings Change vulnerability |
| CVE-2024-54278 | WordPress News Ticker for Elementor plugin <= 2.1.3 - Broken Access Control vulnerability |
| CVE-2024-54289 | WordPress Awesome Support plugin <= 6.3.1 - Broken Access Control vulnerability |
| CVE-2024-54298 | WordPress Car Dealer plugin <= 4.46 - Broken Access Control vulnerability |
| CVE-2024-54310 | WordPress Gou Manage My Account Menu plugin <= 1.0.1.8 - Broken Access Control vulnerability |
| CVE-2024-54311 | WordPress Mark New Posts plugin <= 7.5.1 - Broken Access Control vulnerability |
| CVE-2024-54323 | WordPress New User Approve plugin <= 2.6.2 - Broken Access Control vulnerability |
| CVE-2024-54326 | WordPress GEO my WP plugin <= 4.5.0.4 - Broken Access Control vulnerability |
| CVE-2024-54354 | WordPress Termin-Kalender plugin <= 0.99.47 - Broken Access Control vulnerability |
| CVE-2024-54359 | WordPress Banner System plugin <= 1.0.0 - Broken Access Control vulnerability |
| CVE-2024-54369 | WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability |
| CVE-2024-54378 | WordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2024-54379 | WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2024-54381 | WordPress Advance Menu Manager plugin <= 3.1.1 - Settings Change vulnerability |
| CVE-2024-54384 | WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.8.3 - Broken Access Control vulnerability |
| CVE-2024-54402 | WordPress Arabic Webfonts plugin <= 1.4.6 - Broken Access Control vulnerability |
| CVE-2024-54417 | WordPress PixProof plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2024-5449 | WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 - M... |
| CVE-2024-5453 | ProfileGrid <= 5.8.6 - Missing Authorization |
| CVE-2024-5459 | Restaurant Menu and Food Ordering <= 2.4.16 - Missing Authorization to Menu Creation |
| CVE-2024-10533 | WP Chat App <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation |
| CVE-2024-10535 | Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion |
| CVE-2024-10536 | FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Autho... |
| CVE-2024-10537 | WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Met... |
| CVE-2024-10542 | Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticate... |
| CVE-2024-10543 | Tumult Hype Animations <= 1.9.14 - Missing Authorization |
| CVE-2024-10567 | TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access |
| CVE-2024-10574 | Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Creden... |
| CVE-2024-10575 | CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and pote... |
| CVE-2024-10579 | Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure |
| CVE-2024-10580 | Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission |
| CVE-2024-10582 | Music Player for Elementor – Audio Player & Podcast Player <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Te... |
| CVE-2024-10586 | Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation |
| CVE-2024-10588 | Debug Tool <= 2.2 - Missing Authorization to Information Exposure |
| CVE-2024-10589 | Leopard <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2024-10591 | MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Autho... |
| CVE-2024-10813 | Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposure |
| CVE-2024-10824 | Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Acc... |
| CVE-2024-10852 | Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export |
| CVE-2024-10853 | Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletion |
| CVE-2024-10854 | Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import |
| CVE-2024-10860 | NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation... |
| CVE-2024-10861 | Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 4.9.7 - Missing Authorization to Unauthenticated Limited... |
| CVE-2024-10866 | Export Import Menus <= 1.9.1 - Missing Authorization to Unauthenticated Menu Export |
| CVE-2024-1089 | ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in optimizeAllOn |
| CVE-2024-10897 | Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation |
| CVE-2024-1090 | ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in stopOptimizeAll |
| CVE-2024-10900 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitra... |
| CVE-2024-1091 | ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Plugin Data Removal in reinitialize |
| CVE-2024-1093 | Change Memory Limit <= 1.0 - Missing Authorization via admin_logic() |
| CVE-2024-1094 | Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Au... |
| CVE-2024-1095 | Build & Control Block Patterns – Boost up Gutenberg Editor <= 1.3.5.4 - Missing Authorization |
| CVE-2024-11069 | WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion |
| CVE-2024-1108 | Plugin Groups <= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service |
| CVE-2024-11085 | WP Log Viewer <= 1.2.1 - Missing Authorization |
| CVE-2024-1109 | Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Export |
| CVE-2024-1110 | Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import |
| CVE-2024-11104 | Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart,... |
| CVE-2024-11125 | GetSimpleCMS profile.php cross-site request forgery |
| CVE-2024-11133 | Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download |
| CVE-2024-11134 | Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export |
| CVE-2024-1126 | EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee L... |
| CVE-2024-1127 | EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Expo... |
| CVE-2024-11270 | WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Crea... |
| CVE-2024-11271 | WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Webinar Updates |
| CVE-2024-11281 | WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change |
| CVE-2024-1129 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred() |
| CVE-2024-1130 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read() |
| CVE-2024-11323 | AI Quiz | Quiz Maker <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2024-1133 | Tutor LMS <= 2.6.0 - Missing Authorization |
| CVE-2024-11334 | My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export |
| CVE-2024-11353 | SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion |
| CVE-2024-11496 | Infility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update |
| CVE-2024-1158 | Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 -... |
| CVE-2024-11583 | Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.9 - Missing Authorization to Icon Font... |
| CVE-2024-11601 | Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart,... |
| CVE-2024-11643 | Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update |
| CVE-2024-1181 | Coming Soon, Under Construction & Maintenance Mode By Dazzler <= 2.1.2 - Maintenance Mode Bypass |
| CVE-2024-11816 | The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Exe... |
| CVE-2024-11840 | RapidLoad – Optimize Web Vitals Automatically <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings... |
| CVE-2024-11844 | IdeaPush <= 8.71 - Missing Authorization to Board Term Deletion |
| CVE-2024-11848 | NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update |
| CVE-2024-11851 | NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update |
| CVE-2024-11852 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing... |
| CVE-2024-11911 | WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation |
| CVE-2024-11916 | The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Si... |
| CVE-2024-11918 | Image Alt Text <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update |
| CVE-2024-11926 | Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions |
| CVE-2024-11929 | Responsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting |
| CVE-2024-11936 | Zox News <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2024-11972 | Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation |
| CVE-2024-12006 | W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation |
| CVE-2024-12018 | Snippet Shortcodes <= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion |
| CVE-2024-12026 | Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation |
| CVE-2024-12027 | Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions |
| CVE-2024-12028 | Friends <= 3.2.1 - Missing Authorization |
| CVE-2024-12033 | Jupiter X Core <= 4.8.5 - Missing Authorization to Authenticated Library Sync |
| CVE-2024-5654 | CF7 Google Sheets Connector <= 5.0.9 - Missing Authorization to Limited Site Configuration Update |
| CVE-2024-5669 | XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subs... |
| CVE-2024-5674 | Newsletter - API v1 and v2 addon for Newsletter <= 2.4.5 - Missing Authorization to Email Subscribers Management |
| CVE-2024-5677 | Featured Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload |
| CVE-2024-5685 | Broken Function Level Authorization (BFLA) in snipe/snipe-it |
| CVE-2024-5703 | Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization |
| CVE-2024-5704 | XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subs... |
| CVE-2024-5710 | Improper Access Control in Team Management in berriai/litellm |
| CVE-2024-5899 | Improper trust check in Bazel Build intellij plugin |
| CVE-2024-5939 | GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure |
| CVE-2024-5940 | GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update |
| CVE-2024-5941 | GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited Fi... |
| CVE-2024-5987 | WP Accessibility Helper <= 0.6.2.8 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update |
| CVE-2024-5992 | Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update |
| CVE-2024-5993 | Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update |
| CVE-2024-5997 | Duplica <= 0.6 - Authenticated (Subscriber+) Missing Authorization to Users/Posts Duplicates Creation |
| CVE-2024-6303 | Missing Authorization in Conduit |
| CVE-2024-6332 | Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive I... |
| CVE-2024-6366 | User Profile Builder < 3.11.8 - Unauthenticated Media Upload |
| CVE-2024-6392 | Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update |
| CVE-2024-6406 | Sensetive Data Exposure in Yordam Information Technology's Mobile Library Application |
| CVE-2024-6579 | Web and WooCommerce Addons for WPBakery Builder <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settin... |
| CVE-2024-6590 | Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Googl... |
| CVE-2024-6591 | Ultimate WordPress Auction Plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation |
| CVE-2024-6599 | Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification |
| CVE-2024-6621 | WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update |
| CVE-2024-6626 | EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization |
| CVE-2024-6631 | ImageRecycle pdf & image compression <= 3.1.14 - Missing Authorization in Several AJAX Actions |
| CVE-2024-6636 | WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation |
| CVE-2024-6688 | Oxygen Builder <= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update |
| CVE-2024-6698 | FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation |
| CVE-2024-6709 | Sync Post With Other Site <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Post Creation and Update |
| CVE-2024-6869 | Falang multilanguage for WordPress <= 1.3.52 - Missing Authorization to Translation Update and Information Exposure |
| CVE-2024-6872 | Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor... |
| CVE-2024-6883 | Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorizati... |
| CVE-2024-6987 | Orchid Store <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation |
| CVE-2024-7030 | Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update |
| CVE-2024-7031 | File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update |
| CVE-2024-7032 | Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion |
| CVE-2024-7043 | Improper Access Control in open-webui/open-webui |
| CVE-2024-7045 | Без описания... |
| CVE-2024-7046 | Без описания... |
| CVE-2024-7135 | Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read |
| CVE-2024-7258 | WooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Deletion |
| CVE-2024-7380 | Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion |
| CVE-2024-7381 | Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution |
| CVE-2024-7390 | WP Testimonial Widget <= 3.1 - Missing Authorization |
| CVE-2024-7447 | Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authoriz... |
| CVE-2024-7475 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-7491 | HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe |
| CVE-2024-7605 | HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update |
| CVE-2024-7621 | Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.2 - Missing Authorization to Authenticated (Subsc... |
| CVE-2024-7622 | Revision Manager TMC <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending |
| CVE-2024-7648 | Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure |
| CVE-2024-7714 | AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls |
| CVE-2024-7721 | HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limit... |
| CVE-2024-7727 | HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_... |
| CVE-2024-7767 | Improper Access Control in danswer-ai/danswer |
| CVE-2024-7786 | Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak |
| CVE-2024-7856 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscr... |
| CVE-2024-12920 | FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Missing Authorization in Multiple Functions |
| CVE-2024-12922 | Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current |
| CVE-2024-12955 | PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery |
| CVE-2024-13060 | Improper Authorization in mintplex-labs/anything-llm |
| CVE-2024-1307 | Smart Forms < 2.6.94 - Subscriber+ Edit Entries via Broken Access Control |
| CVE-2024-1318 | RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication |
| CVE-2024-13203 | kurniaramadhan E-Commerce-PHP cross-site request forgery |
| CVE-2024-1322 | Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change |
| CVE-2024-13231 | WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update |
| CVE-2024-13232 | WordPress Awesome Import & Export Plugin - Import & Export WordPress Data <= 4.1.1 - Missing Authorization to Authenticated (... |
| CVE-2024-1324 | QQWorld Auto Save Images <= 1.9.8 - Missing Authorization to Arbitrary Post Content Retrieval |
| CVE-2024-13243 | Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007 |
| CVE-2024-1328 | Newsletter2Go <= 4.0.14 - Authenticated(Subscriber+) Stored Cross-Site Scripting via style |
| CVE-2024-13303 | Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069 |
| CVE-2024-13307 | Reales WP - Real Estate WordPress Theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite... |
| CVE-2024-13312 | Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076 |
| CVE-2024-13316 | Scratch & Win – Giveaways and Contests <= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation |
| CVE-2024-13335 | Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spe... |
| CVE-2024-13358 | BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authentic... |
| CVE-2024-13361 | AI Power: Complete AI Pack <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution |
| CVE-2024-13364 | Raptive Ads <= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings Reset |
| CVE-2024-13367 | Sandbox <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download |
| CVE-2024-13368 | Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.4 - Missing Authorizati... |
| CVE-2024-1337 | SKT Page Builder <= 4.1 - Missing Authorization to Authenticated(Subscriber+) Content Injection |
| CVE-2024-13370 | Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorizati... |
| CVE-2024-13371 | WP Job Portal <= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending |
| CVE-2024-13374 | WP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disc... |
| CVE-2024-1340 | Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization |
| CVE-2024-13412 | CozyStay <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler |
| CVE-2024-13415 | Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 5.1.4 - Missing Authorization to Authenticated (Subscriber+)... |
| CVE-2024-13419 | Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting |
| CVE-2024-13423 | Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation |
| CVE-2024-13424 | Ni Sales Commission For WooCommerce <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update |
| CVE-2024-13439 | Team – Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2024-13447 | WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval |
| CVE-2024-13449 | Boom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update |
| CVE-2024-13468 | Trash Duplicate and 301 Redirect <= 1.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion |
| CVE-2024-13637 | Demo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation |
| CVE-2024-13639 | Read More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion |
| CVE-2024-13643 | Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification |
| CVE-2024-13651 | RapidLoad – Optimize Web Vitals Automatically <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Limited Setting... |
| CVE-2024-13652 | ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion |
| CVE-2024-13653 | ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Opt... |
| CVE-2024-13654 | ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Opt... |
| CVE-2024-13655 | Flex Mag - Responsive WordPress News Theme <= 3.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option D... |
| CVE-2024-13656 | Click Mag - Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrar... |
| CVE-2024-13677 | GetBookingsWp - Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via... |
| CVE-2024-1368 | Page Duplicator <= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplication |
| CVE-2024-13686 | VW Storefront <= 0.9.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset |
| CVE-2024-13687 | Team Builder – Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2024-13698 | Jobify - Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary... |
| CVE-2024-13703 | CRM and Lead Management by vcita <= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget Toggle |
| CVE-2024-1371 | LeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion |
| CVE-2024-13715 | zStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing |
| CVE-2024-13716 | Forex Calculators <= 1.3.7 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2024-13717 | Contact Form and Calls To Action by vcita <= 2.7.1 - Missing Authorization to Authenticated (Subscriber+) Contact/Widget Togg... |
| CVE-2024-1385 | WP-Stateless – Google Cloud Storage <= 3.4.0 - Missing Authorization to Limited Arbitrary Options Update |
| CVE-2024-1387 | Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure |
| CVE-2024-1388 | Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset |
| CVE-2024-1389 | Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authoriz... |
| CVE-2024-1390 | Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authoriz... |
| CVE-2024-13994 | Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization |
| CVE-2024-1400 | Mollie Forms <= 2.6.3 - Missing Authorization to Arbitrary Post Duplication |
| CVE-2024-14032 | Twitch Studio LauncherHelper XPC Missing Authorization to Root File Write |
| CVE-2024-1438 | WordPress Rolo Slider plugin <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2024-1502 | Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Po... |
| CVE-2024-1516 | WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation |
| CVE-2024-1539 | Missing Authorization in GitLab |
| CVE-2024-1562 | WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorization |
| CVE-2024-1566 | Redirects <= 1.2.1 - Missing Authorization via save |
| CVE-2024-1587 | Newsmatic <= 1.3.4 - Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_content |
| CVE-2024-1634 | Scheduling Plugin – Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection |
| CVE-2024-1637 | 360 Javascript Viewer <= 1.7.12 - Missing Authorization to Plugin Settings Update |
| CVE-2024-1639 | License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposu... |
| CVE-2024-1641 | Accordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication |
| CVE-2024-1645 | Mollie Forms <= 2.6.3 - Missing Authorization |
| CVE-2024-1649 | Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory |
| CVE-2024-1650 | Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory |
| CVE-2024-1652 | Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory |
| CVE-2024-1653 | Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition |
| CVE-2024-1662 | Information Disclosure in Porty's PowerBank |
| CVE-2024-1677 | Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Improper Authorization |
| CVE-2024-9671 | System: pdf invoices of the developer users can be seen if the url is known |
| CVE-2024-9685 | Notification for Telegram <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message |
| CVE-2024-9686 | Order Notification for Telegram <= 1.0.1 - Missing Authorization to Unauthenticated Send Telegram Test Message |
| CVE-2024-9697 | Social Rocket – Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Update |
| CVE-2024-9705 | Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Template Name Update |
| CVE-2024-9706 | Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Unauthenticated Template Activation |
| CVE-2024-9707 | Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation |
| CVE-2024-9756 | Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File U... |
| CVE-2024-9824 | ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post T... |
| CVE-2024-9829 | Download Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download |
| CVE-2024-9860 | Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import |
| CVE-2024-9891 | Multiline files upload for contact form 7 <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation |
| CVE-2025-0067 | Missing Authorization check in SAP NetWeaver Application Server Java |
| CVE-2025-0068 | Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP |
| CVE-2025-0466 | Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message Disclosure |
| CVE-2025-0515 | Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscr... |
| CVE-2025-0763 | Ultimate Classified Listings <= 1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update |
| CVE-2025-0836 | XProtect MIP API Missing Authorization |
| CVE-2025-0856 | PGS Core <= 5.8.0 - Missing Authorization via Multiple Functions |
| CVE-2025-0935 | Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change |
| CVE-2025-0939 | MagicForm - WordPress Form Builder <= 1.6.2 - Missing Authorization |
| CVE-2025-0951 | LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated |
| CVE-2025-0952 | Eco Nature - Environment & Ecology WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Op... |
| CVE-2025-0954 | WP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import |
| CVE-2025-0955 | VidoRev Extensions <= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import |
| CVE-2025-10008 | Translate WordPress and go Multilingual – Weglot <= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion |
| CVE-2025-10040 | WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP C... |
| CVE-2025-10054 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Remo... |
| CVE-2025-10173 | ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Aut... |
| CVE-2025-10184 | OnePlus OxygenOS Telephony provider permission bypass |
| CVE-2025-10186 | WhyDonate – FREE Donate button – Crowdfunding – Fundraising <= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_... |
| CVE-2025-1021 | Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and... |
| CVE-2025-10212 | SiteAlert (Formerly WP Health) <= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information Exposure |
| CVE-2025-10299 | WPBifröst – Instant Passwordless Temporary Login Links <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Privil... |
| CVE-2025-10303 | Library Management System <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Manipulation |
| CVE-2025-10304 | Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthentica... |
| CVE-2025-10305 | Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion |
| CVE-2025-10313 | Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting |
| CVE-2025-10352 | Missing Authorization vulnerability in Melis Platform |
| CVE-2025-10476 | WP Fastest Cache <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) DB Cleanup Actions |
| CVE-2025-10489 | SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form C... |
| CVE-2025-1055 | K7 Security Anti-Malware: IOCTL in K7RKScan.sys Allows Arbitrary Termination of High-Privilege and System Processes by a Low-... |
| CVE-2025-10579 | BackWPup <= 5.5.0 - Missing Authorization to Sensitive Information Exposure |
| CVE-2025-10583 | WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgery |
| CVE-2025-10637 | Social Feed Gallery <= 4.9.2 - Missing Authorization to Unauthenticated Information Exposure |
| CVE-2025-10638 | NS Maintenance Mode for WP <= 1.3.1 - Unauthenticated Subscribers Export |
| CVE-2025-10646 | Search Exclude <= 2.5.7 – Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST API |
| CVE-2025-10648 | Login with YourMembership - YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure v... |
| CVE-2025-10690 | Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin... |
| CVE-2025-10694 | User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Info... |
| CVE-2025-10706 | Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation |
| CVE-2025-10732 | SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Inform... |
| CVE-2025-1074 | Webkul QloApps URL mylogout cross-site request forgery |
| CVE-2025-10749 | Microsoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletio... |
| CVE-2025-10753 | OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missing Authorization |
| CVE-2025-1084 | Mindskip xzs-mysql 学之思开源考试系统 cross-site request forgery |
| CVE-2025-10849 | Felan Framework <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via... |
| CVE-2025-10871 | Missing Authorization in GitLab |
| CVE-2025-10873 | Elementinvader Addons for Elementor < 1.4.1 – Unauthenticated Arbitrary Email Sending |
| CVE-2025-10896 | Multiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Upload |
| CVE-2025-10901 | Originality.ai AI Checker <= 1.0.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure v... |
| CVE-2025-1091 | Broken Authorization Schema |
| CVE-2025-10915 | Dreamer Blog <= 1.2 - Subscriber+ Arbitrary Plugin Installation |
| CVE-2025-10938 | UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure |
| CVE-2025-11003 | UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting |
| CVE-2024-5468 | WordPress Header Builder Plugin – Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion |
| CVE-2024-5489 | Wbcom Designs - Custom Font Uploader <= 2.3.4 - Missing Authorization to Font Deletion |
| CVE-2024-55408 | An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizin... |
| CVE-2024-5541 | Ibtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update |
| CVE-2024-5545 | Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization |
| CVE-2024-5570 | Simple Photoswipe <= 0.1 - Subscriber+ Arbitrary Settings Update |
| CVE-2024-55876 | XWiki's scheduler in subwiki allows scheduling operations for any main wiki user |
| CVE-2024-55879 | XWiki allows RCE from script right in configurable sections |
| CVE-2024-55991 | WordPress CRM Plugin – WP-CRM System plugin <= 3.2.9.1 - Broken Access Control vulnerability |
| CVE-2024-55992 | WordPress WooCommerce Basic Ordernumbers plugin <= 1.4.4 - Broken Access Control vulnerability |
| CVE-2024-55993 | WordPress Job Board Manager plugin <= 2.1.61 - Broken Access Control vulnerability |
| CVE-2024-55994 | WordPress 畅言评论系统 plugin <= 2.0.5 - Broken Access Control vulnerability |
| CVE-2024-55995 | WordPress Torod plugin <= 1.7 - Settings Change vulnerability |
| CVE-2024-55996 | WordPress Payment gateway per Product for WooCommerce plugin <= 3.5.6 - Broken Access Control vulnerability |
| CVE-2024-55997 | WordPress Order Delivery & Pickup Location Date Time plugin <= 1.1.0 - Settings Change vulnerability |
| CVE-2024-55998 | WordPress Popup Surveys & Polls for WordPress (Mare.io) plugin <= 1.36 - Settings Change vulnerability |
| CVE-2024-55999 | WordPress XML Multilanguage Sitemap Generator plugin <= 2.0.6 - Broken Access Control vulnerability |
| CVE-2024-5600 | Happy SCSS Compiler - Compile SCSS to CSS automatically <= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stor... |
| CVE-2024-56001 | WordPress Ksher plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2024-56002 | WordPress Contact Form, Survey & Form Builder – MightyForms plugin <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2024-56003 | WordPress Caldera SMTP Mailer plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2024-56004 | WordPress Easy Site Importer plugin <= 1.0.1 - Settings Change vulnerability |
| CVE-2024-56006 | WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability |
| CVE-2024-56007 | WordPress Leader plugin <= 2.6.1 - Broken Access Control vulnerability |
| CVE-2024-56008 | WordPress Spreadr Woocommerce plugin <= 1.0.4 - Arbitrary Content Deletion vulnerability |
| CVE-2024-56009 | WordPress Spreadr Woocommerce plugin <= 1.0.4 - Broken Access Control vulnerability |
| CVE-2024-56031 | WordPress Smart Shopify Product plugin <= 1.0.2 - Arbitrary Content Deletion vulnerability |
| CVE-2024-56048 | WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2024-56061 | WordPress RepairBuddy plugin <= 3.8119 - Account Takeover vulnerability |
| CVE-2024-56066 | WordPress Agency Toolkit plugin <= 1.0.23 - Privilege Escalation vulnerability |
| CVE-2024-56067 | WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability |
| CVE-2024-5607 | GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Script... |
| CVE-2024-56070 | WordPress WP SuperBackup plugin <= 2.3.3 - Multiple Subscriber+ Broken Access Control vulnerabilities |
| CVE-2024-56211 | WordPress UserPro plugin <= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerability |
| CVE-2024-56215 | WordPress Member Directory and Contact Form plugin <= 1.7.0 - Broken Access Control vulnerability |
| CVE-2024-56217 | WordPress Download Manager plugin <= 3.3.03 - Broken Access Control vulnerability |
| CVE-2024-56219 | WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability |
| CVE-2024-56225 | WordPress Premium Addons for Elementor plugin <= 4.10.56 - Broken Access Control vulnerability |
| CVE-2024-56227 | WordPress Royal Elementor Addons plugin <= 1.7.1001 - Broken Access Control vulnerability |
| CVE-2024-56234 | WordPress VW Automobile Lite theme <= 2.1 - Broken Access Control vulnerability |
| CVE-2024-56236 | WordPress Hestia Nginx Cache plugin <= 2.4.0 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-56238 | WordPress Floating Action Buttons plugin <= 0.9.1 - Broken Access Control vulnerability |
| CVE-2024-56243 | WordPress WPSSO Core plugin <= 18.18.1 - Broken Access Control vulnerability |
| CVE-2024-56244 | WordPress Ashe Extra plugin <= 1.2.92 - Broken Access Control vulnerability |
| CVE-2024-56253 | WordPress Data Tables Generator by Supsystic plugin <= 1.10.36 - Broken Access Control vulnerability |
| CVE-2024-56255 | WordPress AyeCode Connect plugin <= 1.3.8 - Broken Access Control vulnerability |
| CVE-2024-56266 | WordPress MP3 Audio Player plugin <= 5.8 - Broken Access Control vulnerability |
| CVE-2024-56270 | WordPress WP SecureSubmit plugin <= 1.5.20 - Sensitive Data Exposure vulnerability |
| CVE-2024-56271 | WordPress WP SecureSubmit plugin <= 1.5.20 - Broken Access Control vulnerability |
| CVE-2024-56272 | WordPress Hide Category by User Role for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerability |
| CVE-2024-56273 | WordPress WPvivid Backup plugin <= 0.9.106 - Broken Access Control vulnerability |
| CVE-2024-56276 | WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability |
| CVE-2024-56294 | WordPress Nexter Blocks plugin <= 4.0.7 - Broken Access Control vulnerability |
| CVE-2024-56295 | WordPress Poll Maker plugin <= 5.5.6 - Broken Access Control vulnerability |
| CVE-2024-5637 | Market Exporter <= 2.0.19 - Missing Authorization to Arbitrary File Deletion |
| CVE-2024-5641 | One Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting |
| CVE-2024-5648 | LearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update |
| CVE-2024-5768 | MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-5769 | MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Limited Settings Update |
| CVE-2024-5770 | WP Force SSL & HTTPS SSL Redirect <= 1.66 - Missing Authorization to Settings Update |
| CVE-2024-5784 | Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference |
| CVE-2024-5820 | Unprotected WebSocket in stitionai/devika |
| CVE-2024-58337 | Akuvox Smart Intercom S539 Improper Access Control via ServicesHTTPAPI |
| CVE-2024-5855 | Media Hygiene <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion |
| CVE-2024-5856 | Comment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion |
| CVE-2024-5857 | Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authoriz... |
| CVE-2024-5858 | Infographic Maker iList <= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update |
| CVE-2024-5860 | Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion |
| CVE-2024-5861 | WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection |
| CVE-2024-5863 | Easy Image Collage <= 1.13.5 - Missing Authorization to Authenticated (Contributor+) Data Clearance |
| CVE-2024-5864 | Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset |
| CVE-2024-6012 | Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation |
| CVE-2024-6033 | Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contribut... |
| CVE-2024-6069 | Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation |
| CVE-2024-6071 | PTC Creo Elements/Direct License Server Missing Authorization |
| CVE-2024-6088 | LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass |
| CVE-2024-6120 | Sparkle Demo Importer <= 1.4.7 - Missing Authorization to Authorized(Subscriber+) Post/Pages/Attachements Deletion and Demo D... |
| CVE-2024-6155 | Greenshift – animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Re... |
| CVE-2024-6167 | Just Custom Fields <= 3.3.2 - Missing Authorization via AJAX actions |
| CVE-2024-6175 | Booking Ultra Pro <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates |
| CVE-2024-6180 | EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates |
| CVE-2024-6458 | WooCommerce Product Table Lite <= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site Scripting |
| CVE-2024-6465 | WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update |
| CVE-2024-6489 | Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update |
| CVE-2024-6491 | Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update |
| CVE-2024-6500 | InPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Del... |
| CVE-2024-6750 | Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions |
| CVE-2024-6754 | Social Auto Poster <= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw_auto_p... |
| CVE-2024-6755 | Social Auto Poster <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion |
| CVE-2024-6799 | YITH Essential Kit for WooCommerce #1 <= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install... |
| CVE-2024-6805 | Missing Authorization Checks in NI VeriStand Gateway for File Transfer Resources |
| CVE-2024-6806 | Missing Authorization Checks In NI VeriStand Gateway For Project Resources |
| CVE-2024-6824 | Premium Addons for Elementor <= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion an... |
| CVE-2024-6836 | Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Cli... |
| CVE-2024-6846 | SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge |
| CVE-2025-11894 | Shelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update |
| CVE-2025-11975 | FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.2... |
| CVE-2025-11985 | Realty Portal <= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2025-11988 | Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion |
| CVE-2025-11989 | Missing Authorization in GitLab |
| CVE-2025-11991 | JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation |
| CVE-2025-11996 | Find Unused Images <= 1.0.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion |
| CVE-2025-11999 | Add Multiple Marker <= 1.2 - Missing Authorization to Unauthenticated Settings Update |
| CVE-2025-12014 | NGINX Cache Optimizer <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Dynamic Caching Exclusion Update |
| CVE-2025-12015 | Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed <= 2.0.0 - Missing... |
| CVE-2025-12022 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Res... |
| CVE-2025-12023 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Re... |
| CVE-2025-12027 | Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update |
| CVE-2025-12041 | ERI File Library <= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download |
| CVE-2025-12042 | Course Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Export |
| CVE-2025-12043 | Autochat Automatic Conversation <= 1.1.9 - Missing Authorization to Unauthenticated Settings Update |
| CVE-2025-12061 | Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution |
| CVE-2025-1233 | Lafka Plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update |
| CVE-2025-12350 | DominoKit <= 1.1.0 - Missing Authorization to Unauthenticated Settings Update |
| CVE-2025-12354 | Live CSS Preview <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2025-12355 | Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update |
| CVE-2025-12356 | Tickera – WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Updat... |
| CVE-2025-12361 | myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to... |
| CVE-2025-12362 | myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Un... |
| CVE-2025-12370 | Takeads <= 1.0.13 - Missing Authorization to Plugin Settings Deletion |
| CVE-2025-12372 | The Permalinks Cascade <= 2.2 - Missing Authorization To Authenticated (Subscriber+) Plugin Settings Update |
| CVE-2025-12377 | Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gal... |
| CVE-2025-12384 | Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Man... |
| CVE-2025-12389 | Import Export For WooCommerce <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2025-12391 | Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update |
| CVE-2025-12392 | Cryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status Update |
| CVE-2025-12449 | aBlocks – WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification |
| CVE-2025-12469 | FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to... |
| CVE-2025-12481 | WP Duplicate Page <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure |
| CVE-2025-1249 | WordPress Events Manager plugin <= 6.6.4.1 - Broken Access Control vulnerability |
| CVE-2025-12498 | EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking... |
| CVE-2025-12519 | Information disclosure on Administration parameters API endpoint |
| CVE-2025-12526 | Private Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset |
| CVE-2025-12527 | Page & Post Notes <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion |
| CVE-2025-12563 | Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Upload |
| CVE-2025-12573 | Bookingor <= 1.0.12 - Subscriber+ Category Deletion |
| CVE-2025-12574 | Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arb... |
| CVE-2025-12577 | Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Lis... |
| CVE-2025-12579 | Reuters Direct <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset |
| CVE-2025-12582 | Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset |
| CVE-2025-12583 | Simple Downloads List <= 1.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting |
| CVE-2025-12630 | Upload.am File Hosting VPN < 1.0.1 - Contributor+ Arbitrary Option Disclosure |
| CVE-2025-12633 | Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection |
| CVE-2025-12634 | Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update |
| CVE-2025-12639 | wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce <= 1.2.2 - Missing Authorization to Sens... |
| CVE-2025-12640 | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to... |
| CVE-2025-12641 | Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion |
| CVE-2025-12655 | Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write |
| CVE-2025-12665 | Ninja Countdown <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown Deletion |
| CVE-2025-12675 | KiotViet Sync <= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2025-12696 | HelloLeads CRM Form Shortcode <= 1.0 - Unauthenticated Settings Reset |
| CVE-2025-12704 | Missing Authorization in GitLab |
| CVE-2025-12714 | Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings... |
| CVE-2025-12721 | g-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information Exposure |
| CVE-2025-12751 | WSChat – WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset |
| CVE-2025-12778 | Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposure |
| CVE-2025-12782 | Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampe... |
| CVE-2025-12783 | Premmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Up... |
| CVE-2025-1279 | BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2025-12809 | dokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure |
| CVE-2025-12817 | PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege |
| CVE-2025-12820 | Pure WC Variation Swatches <= 1.1.7 - Unauthenticated Settings Update |
| CVE-2025-12822 | WP Login and Register using JWT <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure |
| CVE-2025-12825 | User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure |
| CVE-2025-12826 | Custom Post Type UI <= 1.18.0 - Missing Authorization to Unauthenticated (Previously Administrator+) Custom Post Type Modific... |
| CVE-2025-12841 | Bookit < 2.5.1 – Unauthenticated Settings Update |
| CVE-2025-12845 | Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authen... |
| CVE-2025-12847 | All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticat... |
| CVE-2025-12849 | Contest Gallery <= 28.0.2 - Missing Authorization |
| CVE-2025-1285 | Resido - Real Estate WordPress Theme <= 3.6 - Missing Authorization to Unauthenticated Server-Side Request Forgery and API Ke... |
| CVE-2025-12876 | Projectopia – WordPress Project Management <= 5.1.19 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion |
| CVE-2025-12877 | IDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary... |
| CVE-2025-12887 | Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authentica... |
| CVE-2025-12891 | Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Information Exposure |
| CVE-2025-12892 | Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update |
| CVE-2025-12895 | Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request |
| CVE-2025-12898 | Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure |
| CVE-2025-12900 | FileBird – WordPress Media Library Folders & File Manager <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global... |
| CVE-2025-12924 | rymcu forest BankController.java GlobalResult authorization |
| CVE-2025-12925 | rymcu forest UserDicController.java deleteDic authorization |
| CVE-2025-12934 | Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Upda... |
| CVE-2025-12937 | ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update |
| CVE-2025-12953 | Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.2.0 - Missing Authorization to Authenticated... |
| CVE-2025-12955 | Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure |
| CVE-2025-12961 | Download Panel <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification |
| CVE-2025-12963 | LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart <= 1.2.29 - Missing Authorization to Uanuthe... |
| CVE-2025-12975 | CTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plug... |
| CVE-2025-12979 | Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure |
| CVE-2025-12980 | Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sen... |
| CVE-2025-1299 | Missing Authorization in GitLab |
| CVE-2025-13029 | Knowband Mobile App Builder for wooCommerce < 3.0.0 – Unauthenticated Arbitrary User Deletion |
| CVE-2025-1304 | NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload |
| CVE-2025-13063 | DinukaNavaratna Dee Store authorization |
| CVE-2025-1307 | Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload |
| CVE-2025-1309 | UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.04 - Missing Authorization to Authenticated (Subsc... |
| CVE-2025-13092 | Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Unauthenticated Information Expsoure |
| CVE-2025-13093 | Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Updat... |
| CVE-2025-13119 | Fabian Ros/SourceCodester Simple E-Banking System cross-site request forgery |
| CVE-2024-7858 | Media Library Folders <= 8.2.3 - Missing Authorization on Various Functions |
| CVE-2024-7888 | Classified Listing – Classified ads & Business Directory Plugin <= 3.1.7 - Missing Authorization |
| CVE-2024-7894 | If Menu <= 0.19.1 - Missing Authorization to License Key Update |
| CVE-2024-8001 | VIWIS LMS Print authorization |
| CVE-2024-8042 | Rapid7 Insight Platform Unauthorized Empty Group Creation |
| CVE-2024-8074 | Sensetive Data Exposure in Nomysoft Informatics' Nomysem |
| CVE-2024-8102 | The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2024-8114 | Missing Authorization in GitLab |
| CVE-2024-8121 | The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change |
| CVE-2024-8195 | Permalink Manager Lite <= 2.4.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure |
| CVE-2024-8199 | Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Missing Auth... |
| CVE-2024-8272 | macOS Universal Audio (UAConnect) <= 2.7.0 - Local Privilege Escalation |
| CVE-2024-8289 | MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor P... |
| CVE-2024-8349 | Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation |
| CVE-2024-8350 | Uncanny Groups for LearnDash <= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group Add |
| CVE-2024-8369 | EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure |
| CVE-2024-8427 | Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (... |
| CVE-2024-8430 | Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import |
| CVE-2024-8431 | Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Private G... |
| CVE-2024-8432 | Appointment & Event Booking Calendar Plugin – Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+)... |
| CVE-2024-8434 | Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Upd... |
| CVE-2024-8437 | WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulati... |
| CVE-2024-8480 | Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Uploa... |
| CVE-2024-8513 | QA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update |
| CVE-2024-8548 | KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple... |
| CVE-2024-8552 | Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable |
| CVE-2024-8632 | KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure |
| CVE-2024-8658 | myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce... |
| CVE-2024-8667 | HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authent... |
| CVE-2024-8675 | Soumettre.fr <= 2.1.3 - Missing Authorization |
| CVE-2024-8678 | Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update |
| CVE-2024-8682 | JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration |
| CVE-2024-8700 | Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion |
| CVE-2024-8771 | Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missi... |
| CVE-2024-8860 | Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions |
| CVE-2024-8999 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-9000 | Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary |
| CVE-2024-9025 | Sight – Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handle... |
| CVE-2024-9065 | WP Helper Premium <= 4.6.1 - Missing Authorization in whp_smtp_send_mail_test |
| CVE-2024-9067 | Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorizati... |
| CVE-2024-9095 | Improper Authorization in lunary-ai/lunary |
| CVE-2024-9096 | Improper Authorization in lunary-ai/lunary |
| CVE-2024-9109 | UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset |
| CVE-2024-9161 | Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Met... |
| CVE-2024-9187 | Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion |
| CVE-2024-9189 | EU/UK VAT Manager for WooCommerce <= 2.12.12 - Missing Authorization |
| CVE-2024-9195 | WHMPress - WHMCS Client Area <= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2024-9202 | EDC DataSetResolver policy filtering missing |
| CVE-2024-9223 | WPDash Notes <= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure |
| CVE-2024-9234 | GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload |
| CVE-2024-9361 | Bulk images optimizer: Resize, optimize, convert to webp, rename ... <= 2.0.1 - Missing Authorization to Authenticated (Subsc... |
| CVE-2024-9364 | SendGrid for WordPress <= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion |
| CVE-2024-9520 | UserPlus <= 2.0 - Missing Authorization via Multiple Functions |
| CVE-2024-9578 | Hide Links <= 1.4.2 - Unauthenticated Shortcode Execution |
| CVE-2024-9583 | RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.12 - Missing Authorization |
| CVE-2024-9584 | Image Map Pro <= 6.0.20 - Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete |
| CVE-2024-9586 | Linkz.ai <= 1.1.8 - Missing Authorization to Unauthenticated Plugin Settings Update |
| CVE-2024-9587 | Linkz.ai <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via AJAX |
| CVE-2024-9626 | Editorial Assistant by Sovrn <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post F... |
| CVE-2024-9628 | WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API |
| CVE-2024-9629 | Contact Form 7 + Telegram <= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse |
| CVE-2024-9630 | WPS Telegram Chat <= 4.6.0 - Missing Authorization to Information Exposure |
| CVE-2025-13558 | Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing |
| CVE-2025-1358 | Pix Software Vivaz cross-site request forgery |
| CVE-2025-13603 | WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation |
| CVE-2025-13620 | Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tamper... |
| CVE-2025-13628 | Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Co... |
| CVE-2025-13643 | MongoDB Server may allow queries to be terminated by unauthorized users |
| CVE-2025-13666 | Helloprint <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification |
| CVE-2025-13679 | Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_deta... |
| CVE-2025-13717 | Contact Form vCard Generator <= 2.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-... |
| CVE-2025-13722 | Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder |
| CVE-2025-13734 | IBM Engineering Requirements Management DOORS Next could allow an authenticated user to access and modify data beyond authori... |
| CVE-2025-13741 | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing... |
| CVE-2025-13750 | Converter for Media <= 6.3.2 - Missing Authorization to Authenticated (Subscriber+) Optimized Image Deletion via regenerate-a... |
| CVE-2025-13754 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthentic... |
| CVE-2025-13756 | Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Su... |
| CVE-2025-13766 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscrib... |
| CVE-2025-13772 | Missing Authorization in GitLab |
| CVE-2025-13781 | Missing Authorization in GitLab |
| CVE-2025-13790 | Scada-LTS cross-site request forgery |
| CVE-2025-13794 | Auto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification |
| CVE-2025-13921 | weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update |
| CVE-2025-13930 | Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attac... |
| CVE-2025-13934 | Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrol... |
| CVE-2025-13935 | Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Co... |
| CVE-2025-13950 | OneSignal – Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update |
| CVE-2025-13956 | LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure |
| CVE-2025-13964 | LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification |
| CVE-2025-14001 | WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication |
| CVE-2025-14003 | Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Mod... |
| CVE-2025-1402 | Event Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket Deletion |
| CVE-2025-14146 | Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure |
| CVE-2025-14155 | Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_te... |
| CVE-2025-14170 | Vimeo SimpleGallery <= 0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification |
| CVE-2025-14172 | WP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush |
| CVE-2025-14173 | Perfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion |
| CVE-2025-14270 | OneClick Chat to Order <= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Update |
| CVE-2025-14272 | Rockwell Automation FactoryTalk Analytics PavilionX |
| CVE-2025-14288 | Gallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification |
| CVE-2025-14339 | weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion |
| CVE-2025-14342 | SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection |
| CVE-2025-14350 | Information disclosure via channel mentions in posts |
| CVE-2025-14351 | Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion |
| CVE-2025-14357 | Mega Store Woocommerce <= 5.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Cha... |
| CVE-2025-14358 | WordPress REHub Framework plugin <= 19.9.5 - Broken Access Control vulnerability |
| CVE-2025-14360 | WordPress Blockons plugin <= 1.2.19 - Broken Access Control vulnerability |
| CVE-2025-14361 | WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Settings Change vulnerability |
| CVE-2025-14364 | Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation |
| CVE-2025-14365 | Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletion |
| CVE-2025-14366 | Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation |
| CVE-2025-14367 | Easy Theme Options <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Import |
| CVE-2025-14370 | Quote Comments <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update |
| CVE-2025-14371 | TaxoPress <= 3.41.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Tag Modification |
| CVE-2025-14384 | All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticat... |
| CVE-2025-14386 | Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.12 - Missing Autho... |
| CVE-2025-14392 | Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions |
| CVE-2025-14395 | Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions |
| CVE-2025-14397 | Postem Ipsum <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation in postem_ipsum_generate_us... |
| CVE-2025-14426 | Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update |
| CVE-2025-14427 | Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticat... |
| CVE-2025-14428 | My Sticky Elements <= 2.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion |
| CVE-2025-14434 | Ultimate Post Kit < 4.0.16 – Unauthenticated Arbitrary Post Content Disclosure |
| CVE-2025-14441 | Popupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion |
| CVE-2025-14446 | Popup Builder <= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset |
| CVE-2025-14447 | AnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion |
| CVE-2025-14450 | Wallet System for WooCommerce <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipu... |
| CVE-2025-14455 | Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management |
| CVE-2025-14457 | Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion |
| CVE-2025-14460 | Piraeus Bank WooCommerce Payment Gateway <= 3.1.4 - Missing Authorization to Unauthenticated Arbitrary Order Status Change |
| CVE-2025-14461 | Xendit Payment <= 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid |
| CVE-2025-14463 | Payment Button for PayPal <= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creation |
| CVE-2025-14481 | Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post... |
| CVE-2025-14482 | Crush.pics Image Optimizer <= 1.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update |
| CVE-2025-14508 | MediaCommander – Bring Folders to Media, Posts, and Pages <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media F... |
| CVE-2025-14540 | Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure |
| CVE-2025-14573 | Team Admin Bypass of Invite Permissions via allow_open_invite Field |
| CVE-2025-14581 | HAPPY – Helpdesk Support Ticket System <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply |
| CVE-2025-14592 | Missing Authorization in GitLab |
| CVE-2025-14595 | Missing Authorization in GitLab |
| CVE-2025-14608 | WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification |
| CVE-2025-14609 | Wise Analytics <= 1.1.9 - Missing Authorization to Unauthenticated Arbitrary Analytics Database Disclosure via 'name' Paramet... |
| CVE-2025-14618 | Sweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletion |
| CVE-2025-14629 | Alchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletion |
| CVE-2025-14633 | F70 Lead Document Download <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Download |
| CVE-2025-14657 | Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorizat... |
| CVE-2025-14718 | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing... |
| CVE-2025-14720 | Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Acti... |
| CVE-2025-14741 | Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post'... |
| CVE-2025-14755 | Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference |
| CVE-2025-14757 | Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass |
| CVE-2025-14782 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Formi... |
| CVE-2025-14798 | LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure... |
| CVE-2025-1481 | Shortcode Cleaner Lite <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Export |
| CVE-2025-14817 | Factory Mode App Exists Privilege Escalation Issue Allowing Third-Party Apps to Open ADB |
| CVE-2025-14829 | e-xact-hosted-payment <= 2.0 - Unauthenticated Arbitrary File Deletion |
| CVE-2025-1483 | LTL Freight Quotes – GlobalTranz Edition <= 2.3.12 - Missing Authorization to Unauthenticated Settings Update |
| CVE-2025-14843 | Wizit Gateway for WooCommerce <= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation |
| CVE-2025-14854 | WP-CRM System – Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure... |
| CVE-2025-14864 | Virusdie <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key Disclosure |
| CVE-2025-14880 | Netcash WooCommerce Payment Gateway <= 4.1.3 - Missing Authorization to Unauthenticated Order Status Modification |
| CVE-2025-14886 | Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification |
| CVE-2025-14895 | PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion |
| CVE-2025-14901 | Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay |
| CVE-2025-14913 | Frontend Post Submission Manager Lite <= 1.2.6 - Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletion |
| CVE-2025-14944 | Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage |
| CVE-2025-14947 | All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion |
| CVE-2025-14948 | miniOrange OTP Verification and SMS Notification for WooCommerce <= 4.3.8 - Missing Authorization to Unauthenticated Notifica... |
| CVE-2025-14971 | Link Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/C... |
| CVE-2025-14978 | PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing... |
| CVE-2025-11029 | givanz Vvveb cross-site request forgery |
| CVE-2025-11051 | SourceCodester Pet Grooming Management Software cross-site request forgery |
| CVE-2025-11154 | IDonate < 2.1.13 - Unauthenticated User Deletion |
| CVE-2025-11158 | Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization |
| CVE-2025-11164 | Mavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation |
| CVE-2025-11172 | Check Plagiarism <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2025-11191 | RealPress < 1.1.0 - Unauthenticated Content Creation/Email Sending via REST |
| CVE-2025-11228 | GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Associa... |
| CVE-2025-11237 | Make Email Customizer for WooCommerce <= 1.0.6 - Subscriber+ Arbitrary Options Update |
| CVE-2025-11255 | Password Policy Manager | Password Manager <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log... |
| CVE-2025-11257 | LLM Hubspot Blog Import <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import |
| CVE-2025-11269 | Product Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings Update |
| CVE-2025-11369 | Essential Blocks <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information Disclosure |
| CVE-2025-11370 | Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates |
| CVE-2025-11372 | LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation |
| CVE-2025-11373 | Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider,... |
| CVE-2025-11378 | ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export |
| CVE-2025-11380 | Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure |
| CVE-2025-11438 | JhumanJ OpnForm API Endpoint custom-domains authorization |
| CVE-2025-11439 | JhumanJ OpnForm integrations authorization |
| CVE-2025-11442 | JhumanJ OpnForm API Endpoint cross-site request forgery |
| CVE-2025-11448 | Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery... |
| CVE-2025-11564 | Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update |
| CVE-2025-11580 | PowerJob list authorization |
| CVE-2025-11581 | PowerJob OpenAPIController runJob authorization |
| CVE-2025-11587 | Call Now Button <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Settings Update |
| CVE-2025-11620 | Multiple Roles per User <= 1.0 - Missing Authorization to Authenticated (Custom+) Privilege Escalation |
| CVE-2025-11632 | Call Now Button <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions |
| CVE-2025-11669 | Broken Access Control |
| CVE-2025-11692 | Zip Attachments <= 1.6 - Missing Authorization to Limited File Deletion |
| CVE-2025-11701 | Zip Attachments <= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure |
| CVE-2025-11702 | Missing Authorization in GitLab |
| CVE-2025-11705 | Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Fi... |
| CVE-2025-11725 | Aruba HiSpeed Cache <= 3.0.2 - Missing Authorization to Unauthenticated Plugin's Settings Modification |
| CVE-2025-11726 | Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modifi... |
| CVE-2025-11734 | Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links <= 1.2.5 - Missing Authorization to Authentica... |
| CVE-2025-11742 | WPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure |
| CVE-2025-11754 | Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <=... |
| CVE-2025-11758 | All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation a... |
| CVE-2025-11762 | HubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) In... |
| CVE-2025-11773 | Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authorization to Authenticated... |
| CVE-2025-11791 | Sensitive information disclosure and manipulation due to insufficient authorization checks. The following products are affect... |
| CVE-2025-11816 | Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.5.1 - Missing Authorization to... |
| CVE-2025-11833 | Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Ta... |
| CVE-2025-11835 | Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authoriz... |
| CVE-2025-11877 | User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login |
| CVE-2025-11881 | AppPresser – Mobile App Framework <= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposure |
| CVE-2025-11887 | Supervisor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2025-11890 | Crypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment Bypass |
| CVE-2025-12075 | Order Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure |
| CVE-2025-12081 | ACF Photo Gallery Field <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Attachment Metadata Modification |
| CVE-2025-12085 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Emp... |
| CVE-2025-12091 | Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deact... |
| CVE-2025-12093 | Voidek Employee Portal <= 1.0.7 - Missing Authorization |
| CVE-2025-12113 | Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (S... |
| CVE-2025-12133 | EPROLO Dropshipping <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Tracking Data Modification |
| CVE-2025-12134 | ZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable |
| CVE-2025-1214 | pihome-shc PiHome Role-Based Access Control user_accounts.php authorization |
| CVE-2025-12156 | Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One 2.0.7 - 2.2.6 - Missing Authorization to Authenti... |
| CVE-2025-12157 | Simple User Capabilities <= 1.0 - Missing Authorization to Unauthenticated Capability Reset |
| CVE-2025-12158 | Simple User Capabilities <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation |
| CVE-2025-12165 | Webcake – Landing Page Builder <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2025-12167 | Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset |
| CVE-2025-12168 | Phrase TMS Integration for WordPress <= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log Deletion |
| CVE-2025-12169 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Schedu... |
| CVE-2025-12170 | Checkbox <= 2.8.10 - Missing Authorization to Unauthenticated Log Clearing |
| CVE-2025-12174 | Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authentica... |
| CVE-2025-12175 | The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure |
| CVE-2025-12180 | Qi Blocks <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update |
| CVE-2025-12202 | ajayrandhawa User-Management-PHP-MYSQL web cross-site request forgery |
| CVE-2025-13136 | GSheetConnector For Ninja Forms <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure |
| CVE-2025-13149 | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authent... |
| CVE-2025-13177 | Bdtask/CodeCanyon SalesERP cross-site request forgery |
| CVE-2025-13179 | Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System cross-site request forgery |
| CVE-2025-1325 | WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitra... |
| CVE-2025-1326 | Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reserva... |
| CVE-2025-13309 | Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters <= 1.0.2 - Authenticated (Subs... |
| CVE-2025-13312 | CRM Memberships <= 2.5 - Missing Authorization to Unauthenticated 'ntzcrm_add_new_tag' AJAX Action |
| CVE-2025-13313 | CRM Memberships <= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepa... |
| CVE-2025-13314 | Product Filtering by Categories, Tags, Price Range for WooCommerce <= 1.1.6 - Missing Authorization to Unauthenticated Plugin... |
| CVE-2025-13317 | Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Paramet... |
| CVE-2025-13318 | Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bc... |
| CVE-2025-13334 | Blaze Demo Importer 1.0.0 - 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Database Reset and File Deletion |
| CVE-2025-13342 | Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update |
| CVE-2025-13348 | An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can... |
| CVE-2025-13354 | Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscribe... |
| CVE-2025-13358 | Accessiy By CodeConfig Accessibility <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation |
| CVE-2025-13381 | AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Missing Authorization to Unauthenticated Media File Uploads |
| CVE-2025-13384 | CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation |
| CVE-2025-13386 | Social Images Widget <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion |
| CVE-2025-13391 | Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unaut... |
| CVE-2025-13403 | Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscribe... |
| CVE-2025-13404 | atec Duplicate Page & Post <= 1.2.20 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication and D... |
| CVE-2025-13405 | Ace Post Type Builder <= 1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 't... |
| CVE-2025-13414 | Chamber Dashboard Business Directory <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export |
| CVE-2025-13416 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitra... |
| CVE-2025-13419 | Guest posting / Frontend Posting / Front Editor – WP Front User Submit <= 5.0.0 - Missing Authorization to Unauthenticated Me... |
| CVE-2025-13440 | Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deleti... |
| CVE-2025-13441 | Hide Category by User Role for WooCommerce <= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing |
| CVE-2025-13468 | SourceCodester Alumni Management System Delete admin_class.php delete_event authorization |
| CVE-2025-13472 | Missing authorization in BlazeMeter Jenkins Plugin |
| CVE-2025-13493 | Latest Registered Users <= 1.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via User Data Export |
| CVE-2025-13496 | Moosend Landing Pages <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Option Deletion |
| CVE-2025-13498 | Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure |
| CVE-2025-13528 | Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'expo... |
| CVE-2025-13529 | Unify <= 3.4.9 - Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter |
| CVE-2025-13812 | GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization... |
| CVE-2025-13813 | moxi159753 Mogu Blog v2 Storage Management Endpoint storage authorization |
| CVE-2025-13828 | Mautic user without privileged access to the Marketplace can install and uninstall composer packages |
| CVE-2025-13859 | AffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_custom... |
| CVE-2025-13864 | Breeze – WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache Deletion |
| CVE-2025-13866 | Flow-Flow Social Feed Stream 3.0.0 - 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting... |
| CVE-2025-13880 | WP Social Ninja - Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <=... |
| CVE-2025-14029 | Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter |
| CVE-2025-14034 | ilGhera Support System for WooCommerce <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Delet... |
| CVE-2025-14038 | EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This co... |
| CVE-2025-1404 | Secure Copy Content Protection and Content Locking <= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval v... |
| CVE-2025-14043 | Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation |
| CVE-2025-14045 | URL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload |
| CVE-2025-14047 | WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion |
| CVE-2025-14061 | Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <=... |
| CVE-2025-14064 | BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation |
| CVE-2025-14065 | Simple Bike Rental <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Booking Data Exposure |
| CVE-2025-14067 | Easy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure |
| CVE-2025-14070 | Reviewify <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon Creation |
| CVE-2025-14074 | PDF for Contact Form 7 + Drag and Drop Template Builder <= 6.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbit... |
| CVE-2025-14078 | PAYGENT for WooCommerce <= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulation |
| CVE-2025-14079 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings... |
| CVE-2025-1408 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join G... |
| CVE-2025-14080 | Frontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modification |
| CVE-2025-14103 | Missing Authorization in GitLab |
| CVE-2025-14117 | fit2cloud Halo cross-site request forgery |
| CVE-2025-22629 | WordPress iNET Webkit Plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2025-22643 | WordPress OnePress theme <= 2.3.11 - Broken Access Control vulnerability |
| CVE-2025-22647 | WordPress AIO Performance Profiler plugin <= 1.2 - Broken Access Control vulnerability |
| CVE-2025-22657 | WordPress Atarim plugin <= 4.0.9 - Arbitrary Content Deletion vulnerability |
| CVE-2025-2266 | Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update |
| CVE-2025-22665 | WordPress RapidLoad plugin <= 2.4.4 - Broken Access Control vulnerability |
| CVE-2025-22667 | WordPress Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets plugin <= 1.8.2 - Broken Access Control v... |
| CVE-2025-22668 | WordPress Awesome Event Booking plugin <= 2.7.2 - Broken Access Control vulnerability |
| CVE-2025-2267 | WP01 – Speed, Security, SEO consultant <= 2.6.2 - Authenticated (Subscriber+) Arbitrary File Download |
| CVE-2025-22670 | WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.7.2 - CSRF to Settings Change vulnerability |
| CVE-2025-22671 | WordPress Disable Elementor Editor Translation plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2025-22673 | WordPress EAN Barcode Generator <= 5.3.5 - Broken Access Control vulnerability |
| CVE-2025-22677 | WordPress Uix Shortcodes plugin <= 2.0.3 - Arbitrary Shortcode Execution vulnerability |
| CVE-2025-22681 | WordPress Content Cloner plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-22686 | WordPress CF7 Google Sheets Connector plugin <= 5.0.17 - Broken Access Control vulnerability |
| CVE-2025-22694 | WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability |
| CVE-2025-22696 | WordPress Document Block – Upload & Embed Docs, PDF, PPT, XLS or Any Documents plugin <= 1.1.0 - Broken Access Control vulner... |
| CVE-2025-22698 | WordPress Accessibility Suite by Ability, Inc plugin <= 4.18 - Multiple Broken Access Control vulnerability |
| CVE-2025-22702 | WordPress Photography Theme <= 7.7.2 - Broken Access Control Vulnerability |
| CVE-2025-22715 | WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Arbitrary Content Deletion vulnera... |
| CVE-2025-22717 | WordPress My Tickets plugin <= 2.0.9 - Broken Access Control vulnerability |
| CVE-2025-22720 | WordPress WpRently | WordPress plugin plugin <= 2.2.1 - Broken Access Control vulnerability |
| CVE-2025-22721 | WordPress ApplyOnline plugin <= 2.6.7.1 - Broken Access Control vulnerability |
| CVE-2025-22722 | WordPress Widget Options plugin <= 4.0.8 - Broken Access Control to Notice Dimissal vulnerability |
| CVE-2025-22729 | WordPress VOD Infomaniak plugin <= 1.5.9 - Broken Access Control vulnerability |
| CVE-2025-22730 | WordPress Ksher plugin <= 1.1.2 - Broken Access Control vulnerability |
| CVE-2025-22737 | WordPress WpTravelly Plugin <= 1.8.5 - Broken Access Control vulnerability |
| CVE-2025-23423 | WordPress SendGrid for WordPress plugin <= 1.4 - Broken Access Control vulnerability |
| CVE-2025-23440 | WordPress radSLIDE plugin <= 2.1 - Broken Access Control to Stored Cross-Site Scripting vulnerability |
| CVE-2025-23477 | WordPress Realty Workstation plugin <= 1.0.45 - Broken Access Control vulnerability |
| CVE-2025-23486 | WordPress Database Sync plugin <= 0.5.1 - Sensitive Data Exposure vulnerability |
| CVE-2025-23512 | WordPress Team 118GROUP Agent plugin <= 1.6.0 - Arbitrary Content Deletion vulnerability |
| CVE-2025-23514 | WordPress Loginplus plugin <= 1.2 - Broken Access Control vulnerability |
| CVE-2025-23515 | WordPress ts-tree plugin <= 0.1.1 - Arbitrary Content Deletion vulnerability |
| CVE-2025-23527 | WordPress WC Wallet plugin <= 2.2.0 - Arbitrary Content Deletion vulnerability |
| CVE-2025-23529 | WordPress Minterpress plugin <= 1.0.5 - Arbitrary Content Deletion vulnerability |
| CVE-2025-23534 | WordPress WPLingo plugin <= 1.1.2 - Arbitrary Content Deletion vulnerability |
| CVE-2025-23613 | WordPress WP Journal plugin <= 1.1 - Broken Access Control vulnerability |
| CVE-2025-23615 | WordPress Interactive Page Hierarchy plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-23656 | WordPress Donate visa plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability |
| CVE-2025-23684 | WordPress Debug Tool plugin <= 2.2 - Broken Access Control vulnerability |
| CVE-2025-23761 | WordPress Woo Tuner plugin <= 0.1.2 - Broken Access Control vulnerability |
| CVE-2025-23763 | WordPress WAH Forms plugin <= 1.0 - Sensitive Data Exposure vulnerability |
| CVE-2025-23764 | WordPress Copy Move Posts plugin <= 1.6 - Broken Access Control vulnerability |
| CVE-2025-23766 | WordPress OPSI Israel Domestic Shipments plugin <= 2.8.2 - Broken Access Control vulnerability |
| CVE-2025-23771 | WordPress Push Notification for Post and BuddyPress plugin <= 2.11 - Settings Change vulnerability |
| CVE-2025-23773 | WordPress Delete All Posts plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2025-23776 | WordPress Cache Sniper for Nginx plugin <= 1.0.4.2 - Broken Access Control vulnerability |
| CVE-2025-23778 | WordPress User Sync ActiveCampaign plugin <= 1.3.2 - Broken Access Control vulnerability |
| CVE-2025-23785 | WordPress AI Responsive Gallery Album plugin <= 1.4 - Broken Access Control vulnerability |
| CVE-2025-23849 | WordPress PAPERCITE plugin <= 0.5.18 - Broken Access Control vulnerability |
| CVE-2025-23862 | WordPress Contact Form 7 Anti Spambot plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-23906 | WordPress WordPress Dashboard Tweeter plugin <= 1.3.2 - Settings Change vulnerability |
| CVE-2025-23916 | WordPress WP Meetup plugin <= 2.3.0 - Settings Change vulnerability |
| CVE-2025-23917 | WordPress Chamber Dashboard Business Directory Plugin <= 3.3.8 - Broken Access Control vulnerability |
| CVE-2025-23929 | WordPress Email Capture & Lead Generation Plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2025-23930 | WordPress PayPal Marketing Solutions plugin <= 1.2 - Broken Access Control vulnerability |
| CVE-2025-23954 | WordPress Salvador – AI Image Generator plugin <= 1.0.11 - Broken Access Control vulnerability |
| CVE-2025-23955 | WordPress Xola plugin <= 1.6 - Broken Access Control vulnerability |
| CVE-2025-23957 | WordPress Sur.ly plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2025-23958 | WordPress Editor Wysiwyg Background Color plugin <= 1.0 - Broken Access Control vulnerability |
| CVE-2025-23961 | WordPress WordPress Graphs & Charts Plugin <= 2.0.8 - Broken Access Control vulnerability |
| CVE-2025-23962 | WordPress Goldstar plugin <= 2.1.1 - Broken Access Control vulnerability |
| CVE-2025-23963 | WordPress Mark Posts plugin <= 2.2.4 - Broken Access Control vulnerability |
| CVE-2025-23971 | WordPress KI Live Video Conferences plugin <= 5.5.15 - Broken Access Control Vulnerability |
| CVE-2025-23982 | WordPress Fare Calculator plugin <= 1.1 - CSRF to Stored Cross-Site Scripting vulnerability |
| CVE-2025-23991 | WordPress Product Size Charts Plugin for WooCommerce plugin <= 2.4.5 - Broken Access Control vulnerability |
| CVE-2025-23999 | WordPress Breeze plugin <= 2.2.13 - Broken Access Control vulnerability |
| CVE-2025-24021 | iTop doesn't have mass assignment of fields in the portal form |
| CVE-2025-2407 | Missing Authentication & Authorization in Web-API allows adversary unrestricted access |
| CVE-2025-2420 | 猫宁i Morning cross-site request forgery |
| CVE-2025-24571 | WordPress WP Fast Total Search plugin <= 1.78.258 - Broken Access Control vulnerability |
| CVE-2025-24577 | WordPress Poll Maker plugin <= 5.5.0 - Broken Access Control vulnerability |
| CVE-2025-24580 | WordPress 12 Step Meeting List plugin <= 3.16.5 - Arbitrary Content Deletion vulnerability |
| CVE-2025-24581 | WordPress Instantio plugin <= 3.3.7 - Settings Change vulnerability |
| CVE-2025-24583 | WordPress 12 Step Meeting List plugin <= 3.16.5 - Settings Change vulnerability |
| CVE-2025-24584 | WordPress Ultimate Store Kit Elementor Addons plugin <= 2.3.0 - Broken Access Control vulnerability |
| CVE-2025-24588 | WordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerability |
| CVE-2025-24589 | WordPress JSM Show Post Metadata plugin <= 4.6.0 - Broken Access Control vulnerability |
| CVE-2025-24590 | WordPress picu – Online Photo Proofing Gallery plugin <= 2.4.0 - Broken Access Control vulnerability |
| CVE-2025-24591 | WordPress GDPR CCPA Compliance & Cookie Consent Banner plugin <= 2.7.1 - Broken Access Control vulnerability |
| CVE-2025-24594 | WordPress Linet ERP-Woocommerce Integration plugin <= 3.5.7 - CSRF to Broken Access Control vulnerability |
| CVE-2025-24596 | WordPress WooCommerce Product Table Lite plugin <= 3.8.7 - Broken Access Control vulnerability |
| CVE-2025-24600 | WordPress RSVPMaker plugin <= 11.4.5 - Broken Access Control vulnerability |
| CVE-2025-24603 | WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.10 - Brok... |
| CVE-2025-24604 | WordPress VForm plugin <= 3.0.5 - Broken Access Control vulnerability |
| CVE-2025-24606 | WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Con... |
| CVE-2025-24607 | WordPress IdeaPush plugin <= 8.71 - Broken Access Control vulnerability |
| CVE-2025-24613 | WordPress FV Thoughtful Comments plugin <= 0.3.5 - Broken Access Control vulnerability |
| CVE-2025-24618 | WordPress ElementInvader Addons for Elementor Plugin <= 1.3.1 - Broken Access Control vulnerability |
| CVE-2025-24625 | WordPress Taxonomy/Term and Role based Discounts for WooCommerce plugin <= 5.1 - Cross Site Request Forgery (CSRF) to Setting... |
| CVE-2025-24633 | WordPress Build Private Store For Woocommerce plugin <= 1.0 - Broken Access Control vulnerability |
| CVE-2025-24642 | WordPress Setup Default Featured Image plugin <= 1.2 - Broken Access Control vulnerability |
| CVE-2025-24643 | WordPress WPGuppy plugin <= 1.1.0 - Broken Authentication vulnerability |
| CVE-2025-24649 | WordPress Admin and Site Enhancements (ASE) Plugin <= 7.6.2 - Broken Access Control vulnerability |
| CVE-2025-24652 | WordPress WP Duplicate plugin <= 1.1.6 - Broken Access Control vulnerability |
| CVE-2025-24653 | WordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.1.1 - Broken Access Control vulnerability |
| CVE-2025-24654 | WordPress Squirrly SEO plugin <= 12.4.07 - Broken Access Control vulnerability |
| CVE-2025-24662 | WordPress LearnDash LMS Plugin <= 4.20.0.1 - Broken Access Control vulnerability |
| CVE-2025-24679 | WordPress Internal Links Manager plugin <= 2.5.2 - Broken Access Control vulnerability |
| CVE-2025-24682 | WordPress Super Block Slider plugin <= 2.7.9 - Broken Access Control vulnerability |
| CVE-2025-24691 | WordPress People Lists plugin <= 1.3.10 - Broken Access Control vulnerability |
| CVE-2025-24692 | WordPress Bulk Menu Edit plugin <= 1.3 - Broken Access Control vulnerability |
| CVE-2025-24693 | WordPress Advanced Notifications plugin <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2025-24697 | WordPress Image Gallery – Responsive Photo Gallery plugin <= 1.0.5 - Broken Access Control vulnerability |
| CVE-2025-24705 | WordPress WooCommerce Quick View plugin <= 1.1.1 - Sensitive Data Exposure vulnerability |
| CVE-2025-24725 | WordPress Thim Elementor Kit Plugin <= 1.2.8 - Broken Access Control vulnerability |
| CVE-2025-24734 | WordPress Better Find and Replace plugin <= 1.6.7 - Privilege Escalation vulnerability |
| CVE-2025-24736 | WordPress Post Duplicator plugin <= 2.35 - Broken Access Control vulnerability |
| CVE-2025-24737 | WordPress WP Helper Premium plugin <= 4.6.1 - Broken Access Control vulnerability |
| CVE-2025-24743 | WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability |
| CVE-2025-24744 | WordPress Bridge Core plugin <= 3.3 - Broken Access Control vulnerability |
| CVE-2025-24747 | WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability |
| CVE-2025-24748 | WordPress Avada theme <= 7.11.10 - Broken Access Control vulnerability |
| CVE-2025-24750 | WordPress ExactMetrics plugin <= 8.1.0 - Broken Access Control vulnerability |
| CVE-2025-24751 | WordPress CoBlocks plugin <= 3.1.13 - Broken Access Control vulnerability |
| CVE-2025-24753 | WordPress Kadence Blocks plugin <= 3.3.1 - Broken Access Control vulnerability |
| CVE-2025-24754 | WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability |
| CVE-2025-24757 | WordPress uDesign theme <= 4.11.2 - Broken Access Control vulnerability |
| CVE-2025-24762 | WordPress TicketBAI Facturas para WooCommerce plugin <= 3.45 - Broken Access Control vulnerability |
| CVE-2025-24763 | WordPress bbPress API plugin <= 1.0.14 - Broken Access Control Vulnerability |
| CVE-2025-24776 | WordPress Responsive Flipbooks plugin <= 1.0 - Broken Access Control Vulnerability |
| CVE-2025-24778 | WordPress No Spam At All plugin <= 1.3 - Broken Access Control Vulnerability |
| CVE-2025-14982 | Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure |
| CVE-2025-1502 | IP2Location Redirection <= 1.33.3 - Missing Authorization to Unauthenticated Settings Export |
| CVE-2025-1504 | Post Lockdown <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Post Disclosure |
| CVE-2025-15041 | BackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update |
| CVE-2025-15043 | The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control |
| CVE-2025-15066 | Arbitrary File Download through Path Traversal in Innorix WP |
| CVE-2025-15068 | Account Takeover in Gmission Web FAX |
| CVE-2025-1507 | ShareThis Dashboard for Google Analytics <= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation |
| CVE-2025-15070 | Data Exposure in Gmission Web FAX |
| CVE-2025-1508 | WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download |
| CVE-2025-15115 | Petlibro Smart Pet Feeder Platform through 1.7.31 Authentication Bypass via API endpoint |
| CVE-2025-15157 | Starfish Review Generation & Marketing for WordPress <= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm... |
| CVE-2025-15235 | Quanta Computer｜QOCA aim AI Medical Cloud Platform - Missing Authorization |
| CVE-2025-15260 | MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitr... |
| CVE-2025-1528 | Search and filter pro <= 2.5.19 - Missing Authorization to Authenticated (Subscriber+) Post Meta Exposure |
| CVE-2025-15285 | SEO Flow by LupsOnline <= 2.2.1 - Unauthenticated Arbitrary Post/Category Modification |
| CVE-2025-15289 | Tanium addressed an improper access controls vulnerability in Interact. |
| CVE-2025-15326 | Tanium addressed an improper access controls vulnerability in Patch. |
| CVE-2025-15327 | Tanium addressed an improper access controls vulnerability in Deploy. |
| CVE-2025-15330 | Tanium addressed an improper input validation vulnerability in Deploy. |
| CVE-2025-15347 | Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) A... |
| CVE-2025-15369 | Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation |
| CVE-2025-15390 | PHPGurukul Small CRM edit-user.php authorization |
| CVE-2025-15400 | OpenPix <= 2.13.3 - Subscriber+ Payment Gateway Settings Reset |
| CVE-2025-15405 | PHPEMS cross-site request forgery |
| CVE-2025-15406 | PHPGurukul Online Course Registration authorization |
| CVE-2025-15445 | Restaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation |
| CVE-2025-15466 | Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Manag... |
| CVE-2025-15473 | Timetics < 1.0.52 - Unauthenticated Payment/Booking Status Update |
| CVE-2025-15475 | PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status Modification |
| CVE-2025-15476 | The Bucketlister <= 0.1.5 - Missing Authorization to Authenticated (Subscriber+) Bucket List Modification |
| CVE-2025-15485 | Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call |
| CVE-2025-15507 | Magic Import Document Extractor <= 1.0.5 - Missing Authorization to Unauthenticated Plugin License Status Modification |
| CVE-2025-15510 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exp... |
| CVE-2025-15511 | Rupantorpay <= 2.0.0 - Missing Authorization to Unauthenticated Order Status Modification |
| CVE-2025-15512 | Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation |
| CVE-2025-15516 | All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update |
| CVE-2025-15524 | Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure |
| CVE-2025-15563 | Broken Access Control results in Denial of Service in NesterSoft WorkTime |
| CVE-2025-15565 | Nexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification |
| CVE-2025-1557 | OFCMS cross-site request forgery |
| CVE-2025-1562 | Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Autho... |
| CVE-2025-15634 | HCL BigFix WebUI is affected by a missing authorization vulnerability |
| CVE-2025-1639 | Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installatio... |
| CVE-2025-1643 | Benner ModernaNet SG_AlterarSenha cross-site request forgery |
| CVE-2025-1644 | Benner ModernaNet SG_Gravar cross-site request forgery |
| CVE-2025-1657 | Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post... |
| CVE-2025-1666 | Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics <= 4.4.1 - Missing Authorization to Authenticated (Subscri... |
| CVE-2025-1668 | School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Arbitrary User Deletion |
| CVE-2025-1681 | Cardealer <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS Files |
| CVE-2025-1682 | Cardealer <= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation |
| CVE-2025-1745 | LinZhaoguan pb-cms Logout cross-site request forgery |
| CVE-2025-1766 | Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment... |
| CVE-2025-1891 | shishuocms cross-site request forgery |
| CVE-2025-20164 | A vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticate... |
| CVE-2025-26655 | Missing Authorization check in SAP JIT(Outbound) |
| CVE-2025-26656 | Missing Authorization check in S/4HANA (Manage Purchasing Info Records) |
| CVE-2025-26657 | Information Disclosure vulnerability in SAP KMC WPC |
| CVE-2025-26661 | Missing Authorization check in SAP NetWeaver (ABAP Class Builder) |
| CVE-2025-26733 | WordPress Traveler theme < 3.2.1 - Broken Access Control vulnerability |
| CVE-2025-26741 | WordPress Email Notifications for Updates <= 1.1.6 - Privilege Escalation Vulnerability |
| CVE-2025-26750 | WordPress Vitepos Plugin <= 3.1.3 - Broken Access Control vulnerability |
| CVE-2025-26764 | WordPress Distance Based Shipping Calculator plugin <= 2.0.22 - Settings Change vulnerability |
| CVE-2025-26765 | WordPress Distance Based Shipping Calculator plugin <= 2.0.22 - Broken Access Control vulnerability |
| CVE-2025-26920 | WordPress Customify theme <= 0.4.8 - Broken Access Control vulnerability |
| CVE-2025-26928 | WordPress Order Limit for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability |
| CVE-2025-26942 | WordPress JetTricks plugin <= 1.5.1 - Broken Access Control Vulnerability |
| CVE-2025-26944 | WordPress JetPopup plugin <= 2.0.11 - Broken Access Control Vulnerability |
| CVE-2025-26948 | WordPress Pie Register Premium plugin <= 3.8.3.2 - Broken Access Control vulnerability |
| CVE-2025-26953 | WordPress JetMenu plugin <= 2.4.9 - Broken Access Control Vulnerability |
| CVE-2025-26955 | WordPress Industrial Lite theme <= 1.0.8 - Broken Access Control vulnerability |
| CVE-2025-26956 | WordPress Traveler theme < 3.2.1 - Broken Access Control vulnerability |
| CVE-2025-26958 | WordPress JetBlog plugin <= 2.4.3 - Broken Access Control Vulnerability |
| CVE-2025-26959 | WordPress Administrator Z <= 2025.03.24 - Privilege Escalation Vulnerability |
| CVE-2025-26960 | WordPress Small Package Quotes – Unishippers Edition plugin <= 2.4.9 - Broken Access Control vulnerability |
| CVE-2025-26961 | WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Broken Access Control vulnerability |
| CVE-2025-26968 | WordPress Cloak Front End Email <= 1.9.5 - Broken Access Control Vulnerability |
| CVE-2025-26969 | WordPress PrivateContent plugin <= 8.11.5 - Subscriber+ Site Wide Broken Access Control vulnerability |
| CVE-2025-26975 | WordPress Strong Testimonials plugin <= 3.2.3 - Broken Access Control vulnerability |
| CVE-2025-26983 | WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.3 - Broken Access Control vulnerability |
| CVE-2025-26995 | WordPress Market Exporter plugin <= 2.0.21 - Broken Access Control vulnerability |
| CVE-2025-27000 | WordPress Simple Photo Feed Plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2025-27008 | WordPress Unlimited Timeline < 1.6.1 - Broken Access Control Vulnerability |
| CVE-2025-1777 | BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_p... |
| CVE-2025-1778 | Art Theme <= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option Delete |
| CVE-2025-1780 | BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limi... |
| CVE-2025-1813 | zj1983 zz cross-site request forgery |
| CVE-2025-2025 | Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Func... |
| CVE-2025-20301 | Cisco Secure Firewall Management Center Software Authorization Bypass Vulnerability |
| CVE-2025-20302 | Cisco Secure Firewall Management Center Software Authorization Bypass Vulnerability |
| CVE-2025-20362 | Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or... |
| CVE-2025-2042 | huang-yk student-manage cross-site request forgery |
| CVE-2025-2075 | Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation |
| CVE-2025-2103 | SoundRise Music <= 1.7 - Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2025-2104 | Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post... |
| CVE-2025-2110 | WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions |
| CVE-2025-21396 | Microsoft Account Elevation of Privilege Vulnerability |
| CVE-2025-21416 | Azure Virtual Desktop Elevation of Privilege Vulnerability |
| CVE-2025-2224 | Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing |
| CVE-2025-22260 | WordPress Meta Tag Manager plugin <= 3.1 - Broken Access Control vulnerability |
| CVE-2025-22265 | WordPress EMI Calculator plugin <= 1.1 - Settings Change vulnerability |
| CVE-2025-22280 | WordPress DefendWP Firewall Plugin <= 1.1.0 - Broken Access Control vulnerability |
| CVE-2025-22285 | WordPress Pallet Packaging for WooCommerce Plugin <= 1.1.15 - Broken Access Control vulnerability |
| CVE-2025-22287 | WordPress LTL Freight Quotes – FreightQuote Edition plugin <= 2.3.11 - Broken Access Control vulnerability |
| CVE-2025-22289 | WordPress LTL Freight Quotes – Unishippers Edition plugin <= 2.5.8 - Broken Access Control vulnerability |
| CVE-2025-22291 | WordPress LTL Freight Quotes – Worldwide Express Edition plugin <= 5.0.20 - Arbitrary Content Deletion vulnerability |
| CVE-2025-22298 | WordPress Hive Support plugin <= 1.1.6 - Broken Access Control vulnerability |
| CVE-2025-22299 | WordPress AI for SEO plugin <= 1.2.9 - Broken Access Control vulnerability |
| CVE-2025-22302 | WordPress WP Wand plugin <= 1.2.5 - Broken Access Control vulnerability |
| CVE-2025-22304 | WordPress WP Visitor Statistics plugin <= 7.5 - Broken Access Control vulnerability |
| CVE-2025-22318 | WordPress Standard Box Sizes plugin <= 1.6.13 - Broken Access Control vulnerability |
| CVE-2025-22319 | WordPress MashShare plugin <= 4.0.47 - Broken Access Control vulnerability |
| CVE-2025-22363 | WordPress Allada T-shirt Designer for Woocommerce plugin <= 1.1 - Broken Access Control vulnerability |
| CVE-2025-22385 | An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B appli... |
| CVE-2025-2246 | Missing Authorization in GitLab |
| CVE-2025-22512 | WordPress Help Scout Plugin <= 6.5.6 - Broken Access Control vulnerability |
| CVE-2025-22534 | WordPress Slides & Presentations Plugin <= 0.0.39 - Broken Access Control vulnerability |
| CVE-2025-22541 | WordPress WP Delete Post Copies plugin <= 5.5 - Broken Access Control vulnerability |
| CVE-2025-22543 | WordPress ST Gallery WP plugin <= 1.0.8 - Settings Change vulnerability |
| CVE-2025-22560 | WordPress Saoshyant Page Builder plugin <= 3.8 - Broken Access Control vulnerability |
| CVE-2025-22561 | WordPress Title Experiments Free plugin <= 9.0.4 - Broken Access Control vulnerability |
| CVE-2025-22591 | WordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability |
| CVE-2025-22592 | WordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability |
| CVE-2025-22607 | Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak |
| CVE-2025-22608 | Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) |
| CVE-2025-22609 | Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE) |
| CVE-2025-22610 | Coolify Vulnerable to OAuth Secrets Leak |
| CVE-2025-22611 | Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE) |
| CVE-2025-22612 | Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE) |
| CVE-2025-2262 | Logo Slider <= 3.7.3 - Unauthenticated Arbitrary Shortcode Execution |
| CVE-2025-22739 | WordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerability |
| CVE-2025-22740 | WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerability |
| CVE-2025-2276 | Ultimate Dashboard <= 3.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules Activation/Deactivation |
| CVE-2025-22770 | WordPress Envo Multipurpose theme <= 1.1.6 - Broken Access Control vulnerability |
| CVE-2025-22779 | WordPress WP News Sliders plugin <= 1.0 - Broken Access Control vulnerability |
| CVE-2025-22787 | WordPress Button Block plugin <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2025-22800 | WordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerability |
| CVE-2025-2289 | Zegen - Church WordPress Theme <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Theme Options Updates |
| CVE-2025-2290 | LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing |
| CVE-2025-2298 | Authenticated API Endpoint Allows Arbitrary File Deletion in Dremio Software |
| CVE-2025-23025 | Privilege escalation (PR) through realtime WYSIWYG editing in XWiki |
| CVE-2025-23187 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) |
| CVE-2025-23188 | Missing Authorization check in SAP S/4HANA (RBD) |
| CVE-2025-23189 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) |
| CVE-2025-23190 | Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI) |
| CVE-2025-30894 | WordPress WP Fast Total Search plugin <= 1.79.262 - Broken Access Control vulnerability |
| CVE-2025-30896 | WordPress WP ERP plugin <= 1.13.4 - Broken Access Control vulnerability |
| CVE-2025-30897 | WordPress Analytify plugin <= 5.5.1 - Settings Change vulnerability |
| CVE-2025-30909 | WordPress Conversios.io plugin <= 7.2.3 - Broken Access Control vulnerability |
| CVE-2025-30915 | WordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.19 - Broken Access Control vulnerability |
| CVE-2025-30916 | WordPress Residential Address Detection plugin <= 2.5.4 - Broken Access Control vulnerability |
| CVE-2025-30926 | WordPress King Addons for Elementor plugin <= 24.12.58 - Broken Access Control Vulnerability |
| CVE-2025-30927 | WordPress Wordapp plugin <= 1.7.0 - Broken Access Control Vulnerability |
| CVE-2025-30929 | WordPress fluXtore plugin <= 1.6.0 - Broken Access Control vulnerability |
| CVE-2025-30932 | WordPress WP Compress for MainWP plugin <= 6.30.32 - Broken Access Control Vulnerability |
| CVE-2025-30934 | WordPress 診断ジェネレータ作成プラグイン plugin <= 1.4.16 - Broken Access Control Vulnerability |
| CVE-2025-30944 | WordPress Tablesome Table Premium <= 1.1.23 - Broken Access Control Vulnerability |
| CVE-2025-30945 | WordPress Taskbuilder plugin <= 4.0.7 - Broken Access Control Vulnerability |
| CVE-2025-30957 | WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Broken Access Control Vulnerability |
| CVE-2025-30958 | WordPress onOffice for WP-Websites plugin <= 6.5.1 - Broken Access Control vulnerability |
| CVE-2025-30959 | WordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control Vulnerability |
| CVE-2025-30960 | WordPress FS Poster plugin <= 6.5.8 - Subscriber+ Site Wide Broken Access Control vulnerability |
| CVE-2025-30974 | WordPress Post Grid Master plugin <= 3.4.17 - Broken Access Control vulnerability |
| CVE-2025-30978 | WordPress Slack Notifications by dorzki plugin <= 2.0.7 - Broken Access Control Vulnerability |
| CVE-2025-30990 | WordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerability |
| CVE-2025-30993 | WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.7 - Broken Access Control Vulnerability |
| CVE-2025-31000 | WordPress Payment QR WooCommerce plugin <= 1.1.6 - Broken Access Control Vulnerability |
| CVE-2025-31004 | WordPress Rich Table of Contents plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2025-31012 | WordPress Age Gate plugin <= 3.5.4 - Broken Access Control Vulnerability |
| CVE-2025-3124 | Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private re... |
| CVE-2025-31338 | Wisdom Master Pro - Missing Authorization |
| CVE-2025-31376 | WordPress NanoSupport plugin <= 0.6.0 - Broken Access Control vulnerability |
| CVE-2025-31377 | WordPress Woo Product Feed For Marketing Channels plugin <= 1.9.0 - Broken Access Control Vulnerability |
| CVE-2025-31381 | WordPress Booking Calendar and Notification plugin <= 4.0.3 - Broken Authentication vulnerability |
| CVE-2025-31386 | WordPress Simple:Press plugin <= 6.11.5 - Broken Access Control vulnerability |
| CVE-2025-31406 | WordPress ELEX WooCommerce Request a Quote plugin <= 2.3.9 - Broken Access Control vulnerability |
| CVE-2025-31408 | WordPress Zoho Flow plugin <= 2.13.3 - Broken Access Control vulnerability |
| CVE-2025-31415 | WordPress YayExtra <= 1.5.2 - Broken Access Control Vulnerability |
| CVE-2025-31417 | WordPress WP Docs plugin < 2.2.7 - Broken Access Control vulnerability |
| CVE-2025-31425 | WordPress WP Lead Capturing Pages plugin < 2.6 - Arbitrary Content Deletion vulnerability |
| CVE-2025-31469 | WordPress Clear Sucuri Cache plugin <= 1.4 - Broken Access Control Vulnerability |
| CVE-2025-3150 | itning Student Homework Management System cross-site request forgery |
| CVE-2025-31525 | WordPress WP Mobile Bottom Menu plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2025-24972 | Discourse may bypass user preference when adding users to chat groups |
| CVE-2025-24974 | DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability |
| CVE-2025-2506 | When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with C... |
| CVE-2025-25081 | WordPress Embed RSS plugin <= 3.1 - Arbitrary Shortcode Execution vulnerability |
| CVE-2025-25110 | WordPress Event Kikfyre plugin <= 2.1.8 - Broken Access Control vulnerability |
| CVE-2025-25120 | WordPress Slide Banners plugin <= 1.3 - Broken Access Control vulnerability |
| CVE-2025-25167 | WordPress BookPress – For Book Authors Plugin <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2025-25241 | Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests) |
| CVE-2025-25244 | Missing Authorization Check in SAP Business Warehouse (Process Chains) |
| CVE-2025-2568 | Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited A... |
| CVE-2025-26367 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0... |
| CVE-2025-26368 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0... |
| CVE-2025-26369 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0... |
| CVE-2025-26370 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0... |
| CVE-2025-26371 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0... |
| CVE-2025-26372 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0... |
| CVE-2025-26373 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to vers... |
| CVE-2025-26374 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to ver... |
| CVE-2025-26375 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allow... |
| CVE-2025-26376 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allow... |
| CVE-2025-26377 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allow... |
| CVE-2025-26378 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allow... |
| CVE-2025-26773 | WordPress Analytify plugin <= 5.5.0 - Broken Access Control vulnerability |
| CVE-2025-26867 | WordPress Bulk theme <= 1.0.11 - Broken Access Control vulnerability |
| CVE-2025-26871 | WordPress Essential Blocks plugin <= 4.8.3 - Broken Access Control vulnerability |
| CVE-2025-26883 | WordPress Animated Text Block plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2025-26888 | WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.8 - Broken Access Control vulnerability |
| CVE-2025-26901 | WordPress Brizy Pro plugin <= 2.6.1 - Broken Access Control vulnerability |
| CVE-2025-27103 | Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability |
| CVE-2025-2719 | Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2... |
| CVE-2025-27270 | WordPress Residential Address Detection Plugin <= 2.5.4 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2025-27294 | WordPress WP-Asambleas plugin <= 2.85.0 - Arbitrary Shortcode Execution vulnerability |
| CVE-2025-27296 | WordPress Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue Plugin <= 1.5 - Settings Change vulnerability |
| CVE-2025-27310 | WordPress Page and Post Lister plugin <= 1.2.1 - Arbitrary Content Deletion vulnerability |
| CVE-2025-27356 | WordPress Sticky Header On Scroll plugin <= 1.0 - Broken Access Control vulnerability |
| CVE-2025-27428 | Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) |
| CVE-2025-27432 | Missing Authorization check in SAP Electronic Invoicing for Brazil (eDocument Cockpit) |
| CVE-2025-27435 | Information Disclosure Vulnerability in SAP Commerce Cloud |
| CVE-2025-27437 | Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface) |
| CVE-2025-27461 | CVE-2025-27461 |
| CVE-2025-27505 | GeoServer Missing Authorization on REST API Index |
| CVE-2025-2876 | MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User... |
| CVE-2025-28872 | WordPress Block Spam By Math Reloaded plugin <= 2.2.4 - Broken Access Control vulnerability |
| CVE-2025-28920 | WordPress Responsive Google Map plugin <= 3.1.5 - Broken Access Control vulnerability |
| CVE-2025-28938 | WordPress WP Performance Pack plugin <= 2.5.3 - Broken Access Control vulnerability |
| CVE-2025-28962 | WordPress Advanced Google Universal Analytics plugin <= 1.0.3 - Broken Access Control to Sensitive Data Exposure vulnerabilit... |
| CVE-2025-28965 | WordPress URL Shortener <= 3.0.7 - Broken Access Control Vulnerability |
| CVE-2025-28985 | WordPress Elastic Email Subscribe Form plugin <= 1.2.2 - Broken Access Control Vulnerability |
| CVE-2025-28994 | WordPress Viral Loops WP Integration plugin <= 3.8.1 - Broken Access Control Vulnerability |
| CVE-2025-28995 | WordPress Viral Loops WP Integration plugin <= 3.8.1 - Broken Access Control Vulnerability |
| CVE-2025-28996 | WordPress GPP Slideshow plugin <= 1.3.5 - Broken Access Control Vulnerability |
| CVE-2025-28997 | WordPress WP AutoKeyword plugin <= 1.0 - Broken Access Control Vulnerability |
| CVE-2025-29000 | WordPress Multi-language Responsive Contact Form plugin <= 2.8 - Broken Access Control Vulnerability |
| CVE-2025-29001 | WordPress WooCommerce Shop Page Builder plugin <= 2.27.7 - Broken Access Control Vulnerability |
| CVE-2025-29006 | WordPress Direct Checkout for WooCommerce Lite plugin <= 1.0.3 - Broken Access Control Vulnerability |
| CVE-2025-29007 | WordPress LMSACE Connect plugin <= 3.4 - Broken Access Control Vulnerability |
| CVE-2025-29010 | WordPress Behance Portfolio Manager plugin <= 1.7.5 - Broken Access Control vulnerability |
| CVE-2025-29012 | WordPress CF7 7 Mailchimp Add-on plugin < 2.4 - Broken Access Control Vulnerability |
| CVE-2025-29013 | WordPress Custom Category/Post Type Post order plugin <= 1.6.0 - Broken Access Control Vulnerability |
| CVE-2025-2902 | Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform |
| CVE-2025-2907 | Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update |
| CVE-2025-2933 | Email Notifications for Updates <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2025-31780 | WordPress Append Content plugin <= 2.1.1 - CSRF to Settings Change vulnerability |
| CVE-2025-31781 | WordPress Gift Cards for WooCommerce plugin <= 1.5.8 - Broken Access Control vulnerability |
| CVE-2025-31782 | WordPress mb.YTPlayer plugin <= 3.3.8 - Broken Access Control vulnerability |
| CVE-2025-31786 | WordPress Simple Icons plugin <= 2.8.4 - Broken Access Control vulnerability |
| CVE-2025-31787 | WordPress Cue by AudioTheme.com plugin <= 2.4.4 - Broken Access Control vulnerability |
| CVE-2025-31789 | WordPress TextMe SMS plugin <= 1.9.1 - Broken Access Control vulnerability |
| CVE-2025-31791 | WordPress Pin Generator Plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2025-31794 | WordPress WR Price List Manager For Woocommerce plugin <= 1.0.8 - Arbitrary Content Deletion vulnerability |
| CVE-2025-31795 | WordPress Shopify to WooCommerce Migration plugin <= 1.3.0 - Settings Change vulnerability |
| CVE-2025-31798 | WordPress Publitio Plugin <= 2.1.8 - Broken Access Control vulnerability |
| CVE-2025-31799 | WordPress Publitio plugin <= 2.1.8 - Broken Access Control vulnerability |
| CVE-2025-31802 | WordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Settings Change vulnerability |
| CVE-2025-31810 | WordPress Question Answer plugin <= 1.2.73 - Broken Access Control vulnerability |
| CVE-2025-31816 | WordPress Mobile App Canvas Plugin <= 3.8.2 - Broken Access Control vulnerability |
| CVE-2025-31820 | WordPress Automatic Featured Images from Videos plugin <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2025-31822 | WordPress WordPress Simple HTML Sitemap plugin <= 3.4 - Broken Access Control vulnerability |
| CVE-2025-31826 | WordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - Broken Access Control vulnerability |
| CVE-2025-31830 | WordPress Printus Plugin <= 1.2.6 - Broken Access Control vulnerability |
| CVE-2025-31831 | WordPress AtomChat plugin <= 1.1.7 - Broken Access Control vulnerability |
| CVE-2025-31834 | WordPress JobBoard Job listing plugin Plugin <= 1.2.8 - Broken Access Control vulnerability |
| CVE-2025-31836 | WordPress Review Manager plugin <= 2.5.0 - Broken Access Control vulnerability |
| CVE-2025-31841 | WordPress FPW Category Thumbnails Plugin <= 1.9.5 - Broken Access Control vulnerability |
| CVE-2025-31843 | WordPress OpenAI Tools for WordPress & WooCommerce plugin <= 2.2.1 - Broken Access Control vulnerability |
| CVE-2025-31846 | WordPress Theater for WordPress plugin <= 0.18.7 - Broken Access Control vulnerability |
| CVE-2025-31848 | WordPress WordPress Adverts Plugin plugin <= 1.4 - Broken Access Control vulnerability |
| CVE-2025-31854 | WordPress Simple Sticky Add To Cart For WooCommerce plugin <= 1.4.9 - Broken Access Control vulnerability |
| CVE-2025-31856 | WordPress Export All Post Meta Plugin <= 1.2.1 - Broken Access Control vulnerability |
| CVE-2025-31858 | WordPress Local Magic plugin <= 2.9.0 - Broken Access Control vulnerability |
| CVE-2025-31862 | WordPress Job Board Manager Plugin <= 2.1.61 - Broken Access Control vulnerability |
| CVE-2025-31863 | WordPress Agency Toolkit plugin <= 1.0.24 - Broken Access Control vulnerability |
| CVE-2025-31865 | WordPress CartBoss plugin <= 4.1.2 - Broken Access Control vulnerability |
| CVE-2025-31866 | WordPress ShipDepot for WooCommerce plugin <= 1.2.19 - Broken Access Control vulnerability |
| CVE-2025-31868 | WordPress JS Job Manager plugin <= 2.0.2 - Broken Access Control vulnerability |
| CVE-2025-31870 | WordPress WP AutoKeyword plugin <= 1.0 - Arbitrary Content Deletion vulnerability |
| CVE-2025-31872 | WordPress WP Clone any post type Plugin <= 3.6 - Broken Access Control vulnerability |
| CVE-2025-31876 | WordPress Payday plugin <= 3.3.18 - Broken Access Control vulnerability |
| CVE-2025-31877 | WordPress RestroPress plugin <= 3.2.8 - Broken Access Control vulnerability |
| CVE-2025-31878 | WordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Settings Change vulnerability |
| CVE-2025-31879 | WordPress Barcode Generator for WooCommerce plugin <= 2.0.4 - Settings Change vulnerability |
| CVE-2025-31881 | WordPress Pearl plugin <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2025-31882 | WordPress Webinar Plugin <= 1.33.28 - Broken Access Control vulnerability |
| CVE-2025-31886 | WordPress Social proof testimonials and reviews by Repuso plugin <= 5.21 - Broken Access Control vulnerability |
| CVE-2025-31887 | WordPress MyBookProgress plugin <= 1.0.8 - Broken Access Control vulnerability |
| CVE-2025-31896 | WordPress GetBookingsWP Plugin <= 1.1.27 - Broken Access Control vulnerability |
| CVE-2025-31909 | WordPress Apptivo Business Site CRM plugin <= 5.3 - Arbitrary Content Deletion vulnerability |
| CVE-2025-31923 | WordPress CSS3 Accordions for WordPress plugin <= 3.0 - Broken Access Control Vulnerability |
| CVE-2025-32236 | WordPress Woocommerce Products Reorder Drag Drop Multiple Sort plugin <= 1.9 - Broken Access Control vulnerability |
| CVE-2025-32237 | WordPress MasterStudy LMS plugin <= 3.5.28 - Broken Access Control vulnerability |
| CVE-2025-32239 | WordPress Social Share Buttons & Analytics Plugin plugin <= 4.5 - Broken Access Control vulnerability |
| CVE-2025-32240 | WordPress Site Notify plugin <= 1.0 - Broken Access Control Vulnerability |
| CVE-2025-32242 | WordPress Hive Support plugin <= 1.2.5 - Broken Access Control vulnerability |
| CVE-2025-32243 | WordPress Internal Link Optimiser plugin <= 5.1.2 - Settings Change vulnerability |
| CVE-2025-32244 | WordPress SEO Help plugin <= 6.7.9 - Broken Access Control vulnerability |
| CVE-2025-32246 | WordPress 1-Click Backup & Restore Database plugin <= 1.0.3 - Broken Access Control Vulnerability |
| CVE-2025-32252 | WordPress WP Genealogy plugin <= 0.1.9 - Broken Access Control vulnerability |
| CVE-2025-32253 | WordPress Course Booking System Plugin <= 6.1 - Broken Access Control vulnerability |
| CVE-2025-32254 | WordPress WPBookit plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2025-32256 | WordPress SurveyJS plugin <= 1.12.20 - Broken Access Control vulnerability |
| CVE-2025-32258 | WordPress Simple Website Logo plugin <= 1.1 - Broken Access Control vulnerability |
| CVE-2025-32259 | WordPress WP ULike plugin <= 4.7.9.1 - Content Spoofing Vulnerability |
| CVE-2025-32260 | WordPress DethemeKit For Elementor plugin <= 2.1.10 - Broken Access Control vulnerability |
| CVE-2025-32277 | WordPress RepairBuddy plugin <= 3.8213 - Broken Access Control vulnerability |
| CVE-2025-32279 | WordPress Live Forms plugin <= 4.8.5 - Broken Access Control vulnerability |
| CVE-2025-32281 | WordPress DarkMySite plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2025-32295 | WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerability |
| CVE-2025-32296 | WordPress Simple Link Directory Pro plugin < 14.8.1 - Broken Access Control Vulnerability |
| CVE-2025-32308 | WordPress Team Builder plugin <= 1.5.7 - Broken Access Control Vulnerability |
| CVE-2025-32542 | WordPress Eazy Plugin Manager plugin <= 4.3.0 - Broken Access Control vulnerability |
| CVE-2025-27013 | WordPress MediCenter theme < 14.7 - Sensitive Data Exposure vulnerability |
| CVE-2025-2779 | Insert Headers and Footers Code – HT Script <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options U... |
| CVE-2025-2789 | MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated... |
| CVE-2025-2807 | Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitra... |
| CVE-2025-2815 | Administrator Z <= 2025.03.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2025-2816 | Page View Count 2.8.0 - 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update |
| CVE-2025-2821 | Search Exclude <= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modification |
| CVE-2025-2832 | mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 cross-site request forgery |
| CVE-2025-2848 | A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and d... |
| CVE-2025-29756 | MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters |
| CVE-2025-30017 | Missing Authorization check in SAP Solution Manager |
| CVE-2025-30237 | Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices |
| CVE-2025-3037 | yzk2356911358 StudentServlet-JSP cross-site request forgery |
| CVE-2025-30398 | Nuance PowerScribe 360 Information Disclosure Vulnerability |
| CVE-2025-30416 | Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber P... |
| CVE-2025-30543 | WordPress Menu Duplicator plugin <= 1.0 - Broken Access Control vulnerability |
| CVE-2025-3058 | Xelion Webchat <= 9.1.0 - Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2025-30581 | WordPress Top Bar plugin <= 3.3 - Broken Access Control Vulnerability |
| CVE-2025-30591 | WordPress Music Press Pro plugin <= 1.4.6 Broken Access Control Vulnerability |
| CVE-2025-30592 | WordPress Advanced Dewplayer - plugin <= 1.6 Broken Access Control Vulnerability |
| CVE-2025-30605 | WordPress sourceplay-navermap plugin <= 0.0.2 - Broken Access Control vulnerability |
| CVE-2025-30624 | WordPress WordLift plugin <= 3.54.4 - Broken Access Control Vulnerability |
| CVE-2025-3063 | Shopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2025-30636 | WordPress Accessibility Suite plugin <= 4.19 - Broken Access Control Vulnerability |
| CVE-2025-30639 | WordPress IDonatePro Plugin <= 2.1.9 - Broken Access Control Vulnerability |
| CVE-2025-30767 | WordPress PDF for WPForms plugin <= 5.3.0 - Arbitrary Shortcode Execution vulnerability |
| CVE-2025-30772 | WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerabi... |
| CVE-2025-30790 | WordPress Chatbox Manager plugin <= 1.2.2 - Broken Access Control Vulnerability |
| CVE-2025-30797 | WordPress Greek Multi Tool – Fix peralinks, accents, auto create menus and more plugin <= 2.3.1 - Broken Access Control Vulne... |
| CVE-2025-30803 | WordPress Just Writing Statistics plugin <= 5.3 - Broken Access Control vulnerability |
| CVE-2025-30809 | WordPress WordPress Contact Form, Drag and Drop Form Builder Plugin – Live Forms plugin <= 4.8.4 - Settings Change vulnerabil... |
| CVE-2025-30817 | WordPress Z Companion plugin <= 1.0.13 - Broken Access Control vulnerability |
| CVE-2025-30821 | WordPress SNORDIAN's H5PxAPIkatchu plugin <= 0.4.14 - Broken Access Control vulnerability |
| CVE-2025-30824 | WordPress Textmetrics plugin <= 3.6.1 - Broken Access Control vulnerability |
| CVE-2025-30825 | WordPress WPC Smart Linked Products plugin <= 1.3.5 - Privilege Escalation vulnerability |
| CVE-2025-30828 | WordPress Timetics plugin <= 1.0.29 - Broken Access Control vulnerability |
| CVE-2025-30830 | WordPress Cool Author Box plugin <= 2.9.9 - Broken Access Control vulnerability |
| CVE-2025-30839 | WordPress Taxi Booking Manager for WooCommerce plugin <= 1.2.1 - Broken Access Control vulnerability |
| CVE-2025-30851 | WordPress Tickera plugin <= 3.5.5.2 - Broken Access Control vulnerability |
| CVE-2025-30853 | WordPress ShortPixel Adaptive Images plugin <= 3.10.0 - Broken Authentication vulnerability |
| CVE-2025-30855 | WordPress Ads by WPQuads plugin <= 2.0.87.1 - Broken Access Control Vulnerability |
| CVE-2025-30861 | WordPress Five Star Restaurant Reservations plugin <= 2.6.29 - Broken Access Control vulnerability |
| CVE-2025-30864 | WordPress Exchange Rates plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2025-30866 | WordPress Terms & Conditions Per Product plugin <= 1.2.15 - Broken Access Control Vulnerability |
| CVE-2025-30874 | WordPress Specific Content For Mobile plugin <= 0.5.3 - Broken Access Control vulnerability |
| CVE-2025-30877 | WordPress Quiz Cat plugin <= 3.0.8 - Broken Access Control vulnerability |
| CVE-2025-30880 | WordPress JS Help Desk plugin <= 2.9.2 - Broken Access Control vulnerability |
| CVE-2025-30881 | WordPress Big Store theme <= 2.0.8 - Broken Access Control vulnerability |
| CVE-2025-30883 | WordPress Trust.Reviews plugin <= 2.3 - Broken Access Control vulnerability |
| CVE-2025-30887 | WordPress WpEvently Plugin <= 4.2.9 - Broken Access Control vulnerability |
| CVE-2025-31041 | WordPress AnyTrack Affiliate Link Manager plugin <= 1.0.4 - Broken Access Control Vulnerability |
| CVE-2025-31042 | WordPress Sandwich Adsense plugin <= 4.0.2 - Broken Access Control Vulnerability |
| CVE-2025-31046 | WordPress AnyWhere Elementor Pro plugin <= 2.29 - Broken Access Control Vulnerability |
| CVE-2025-31063 | WordPress Wishlist plugin <= 2.1.0 - Broken Access Control Vulnerability |
| CVE-2025-31065 | WordPress Rozario <= 1.4 - Broken Access Control Vulnerability |
| CVE-2025-31066 | WordPress Acerola theme <= 1.6.5 - Broken Access Control Vulnerability |
| CVE-2025-31071 | WordPress HotStar – Multi-Purpose Business Theme <= 1.4 - Broken Access Control Vulnerability |
| CVE-2025-31171 | File read permission bypass vulnerability in the kernel file system module Impact: Successful exploitation of this vulnerabil... |
| CVE-2025-39447 | WordPress JetElements For Elementor plugin <= 2.7.4.1 - Broken Access Control Vulnerability |
| CVE-2025-39449 | WordPress JetWooBuilder plugin <= 2.1.18 - Broken Access Control Vulnerability |
| CVE-2025-39451 | WordPress JetBlocks For Elementor plugin <= 1.3.16 - Broken Access Control Vulnerability |
| CVE-2025-39454 | WordPress Name Directory plugin <= 1.30.0 - Broken Access Control vulnerability |
| CVE-2025-39456 | WordPress WP Logger plugin <= 2.2 - Broken Access Control vulnerability |
| CVE-2025-39457 | WordPress Booking and Rental Manager plugin <= 2.2.8 - Broken Access Control vulnerability |
| CVE-2025-39460 | WordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerability |
| CVE-2025-39465 | WordPress Advanced Google Maps plugin <= 5.8.4 - Broken Access Control vulnerability |
| CVE-2025-39477 | WordPress InWave Jobs Plugin <= 3.5.8 - Broken Access Control vulnerability |
| CVE-2025-39482 | WordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerability |
| CVE-2025-3949 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.18.15 - Missing Au... |
| CVE-2025-39493 | WordPress Rankie plugin < 1.8.2 - Broken Access Control Vulnerability |
| CVE-2025-39511 | WordPress Pinterest Automatic Pin plugin <= 4.19.0 - Broken Access Control Vulnerability |
| CVE-2025-39513 | WordPress ActiveDEMAND plugin <= 0.2.46 - Broken Access Control vulnerability |
| CVE-2025-31528 | WordPress StaticPress plugin <= 0.4.5 - Broken Access Control vulnerability |
| CVE-2025-31529 | WordPress Slider Path for Elementor plugin <= 3.0.0 - Broken Access Control vulnerability |
| CVE-2025-31530 | WordPress Google SEO Pressor Snippet plugin <= 2.0 - Broken Access Control vulnerability |
| CVE-2025-31533 | WordPress Salesmate Add-On for Gravity Forms plugin <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2025-31539 | WordPress Cryptocurrency Widgets Pack plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2025-31540 | WordPress ACME Divi Modules plugin <= 1.3.5 - Broken Access Control vulnerability |
| CVE-2025-31541 | WordPress TuriTop Booking System plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2025-31544 | WordPress Swiss Toolkit For WP plugin <= 1.4.5 - Broken Access Control vulnerability |
| CVE-2025-31545 | WordPress Safe Ai Malware Protection for WP plugin <= 1.0.20 - Broken Access Control vulnerability |
| CVE-2025-31546 | WordPress Swiss Toolkit For WP plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2025-31555 | WordPress ContentMX Content Publisher plugin <= 1.0.6 - Broken Access Control vulnerability |
| CVE-2025-31576 | WordPress PostmarkApp Email Integrator plugin <= 2.4 - Broken Access Control vulnerability |
| CVE-2025-31580 | WordPress Ni WooCommerce Product Enquiry plugin <= 4.1.8 - Broken Access Control vulnerability |
| CVE-2025-31581 | WordPress WP Video Playlist plugin <= 1.1.2 - Settings Change vulnerability |
| CVE-2025-31584 | WordPress Elfsight Testimonials Slider plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-31596 | WordPress Chat by Chatwee plugin <= 2.1.3 - Broken Access Control vulnerability |
| CVE-2025-31603 | WordPress CF7 Spreadsheets plugin <= 2.3.2 - Settings Change vulnerability |
| CVE-2025-31606 | WordPress SP Blog Designer plugin <= 1.0.0 - Arbitrary Shortcode Execution vulnerability |
| CVE-2025-31609 | WordPress WPCargo Track & Trace plugin <= 8.0.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-31611 | WordPress Auto Post After Image Upload plugin <= 1.6 - Broken Access Control vulnerability |
| CVE-2025-31618 | WordPress Connector to CiviCRM with CiviMcRestFace plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2025-31628 | WordPress Sliced Invoices plugin <= 3.10.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-31630 | WordPress The Business <= 1.6.1 - Broken Access Control Vulnerability |
| CVE-2025-31678 | AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004 |
| CVE-2025-31681 | Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009 |
| CVE-2025-31685 | Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014 |
| CVE-2025-31686 | Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015 |
| CVE-2025-31691 | OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020 |
| CVE-2025-31729 | WordPress WooTumblog plugin <= 2.1.4 - Content Injection vulnerability |
| CVE-2025-31732 | WordPress GB Gallery Slideshow plugin <= 1.3 - Broken Access Control vulnerability |
| CVE-2025-31736 | WordPress Rich Text Editor Plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-31739 | WordPress Minimalistic Event Manager plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2025-31746 | WordPress Clients plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2025-31752 | WordPress Bulk Fields Editor plugin <= 1.8.0 - Broken Access Control vulnerability |
| CVE-2025-31755 | WordPress pCloud Backup plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-31757 | WordPress Free Woocommerce Product Table View plugin <= 1.78 - Broken Access Control vulnerability |
| CVE-2025-31758 | WordPress Free Woocommerce Product Table View plugin <= 1.78 - Arbitrary Content Deletion vulnerability |
| CVE-2025-31765 | WordPress GDPR Cookie Notice plugin <= 1.2.0 - Broken Access Control vulnerability |
| CVE-2025-31768 | WordPress Widget Manager Light plugin <= 1.18 - Broken Access Control vulnerability |
| CVE-2025-31773 | WordPress Ship Per Product plugin <= 2.1.0 - Broken Access Control vulnerability |
| CVE-2025-31774 | WordPress plugin Astra Security Suite plugin<= 0.2 - Broken Access Control vulnerability |
| CVE-2025-31777 | WordPress Clockinator Lite plugin <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2025-32045 | Moodle: hidden grades shown to users without permission on some grade reports |
| CVE-2025-32147 | WordPress Easy WP Optimizer Plugin <= 1.1.0 - Broken Access Control vulnerability |
| CVE-2025-32178 | WordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerability |
| CVE-2025-32180 | WordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-32201 | WordPress Xpro Theme Builder Plugin <= 1.2.8.4 - Broken Access Control vulnerability |
| CVE-2025-32208 | WordPress Hive Support plugin <= 1.2.5 - Broken Access Control vulnerability |
| CVE-2025-32210 | WordPress CM Registration and Invitation Codes plugin <= 2.5.6 - Broken Access Control vulnerability |
| CVE-2025-32212 | WordPress Specia Companion plugin <= 6.3 - Broken Access Control vulnerability |
| CVE-2025-32213 | WordPress Flo Forms plugin <= 1.0.43 - Broken Access Control vulnerability |
| CVE-2025-32216 | WordPress Spider Elements – Addons for Elementor plugin <= 1.6.6 - Broken Access Control vulnerability |
| CVE-2025-32217 | WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2025-32218 | WordPress TableOn plugin <= 1.0.5.1 - Broken Access Control vulnerability |
| CVE-2025-32219 | WordPress eaSYNC plugin <= 1.3.19 - Broken Access Control vulnerability |
| CVE-2025-32220 | WordPress Salon booking system plugin <= 10.30.23 - Broken Access Control vulnerability |
| CVE-2025-32544 | WordPress WooCommerce Loyal Customers plugin <= 2.6 - Broken Access Control vulnerability |
| CVE-2025-3257 | xujiangfei admintwo updateSet cross-site request forgery |
| CVE-2025-32593 | WordPress Add Product Frontend for WooCommerce plugin <= 1.0.8 - Arbitrary Content Deletion vulnerability |
| CVE-2025-32620 | WordPress Doppler Forms plugin <= 2.4.6 - Broken Access Control vulnerability |
| CVE-2025-32624 | WordPress Czater.pl – live chat i telefon plugin <= 1.0.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability |
| CVE-2025-32684 | WordPress MapSVG Lite plugin <= 8.6.4 - Broken Access Control Vulnerability |
| CVE-2025-32688 | WordPress Target Video Easy Publish plugin <= 3.8.9 - Arbitrary Code Execution vulnerability |
| CVE-2025-32781 | Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId |
| CVE-2025-32929 | WordPress Barcode Generator for WooCommerce plugin <= 2.0.4 - Arbitrary Content Deletion vulnerability |
| CVE-2025-32973 | org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right |
| CVE-2025-33182 | NVIDIA Jetson Linux contains a vulnerability in UEFI, where improper authentication may allow a privileged user to cause corr... |
| CVE-2025-33185 | NVIDIA AIStore contains a vulnerability in AuthN where an unauthenticated user may cause information disclosure. A successfu... |
| CVE-2025-3417 | Embedder 1.3 - 1.3.5 - Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2025-34171 | CasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure |
| CVE-2025-3437 | Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard... |
| CVE-2025-3452 | SecuPress Free <= 2.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation |
| CVE-2025-3527 | EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cros... |
| CVE-2025-3557 | ScriptAndTools eCommerce-website-in-PHP cross-site request forgery |
| CVE-2025-3561 | ghostxbh uzy-ssm-mall cross-site request forgery |
| CVE-2025-3604 | Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-36192 | Missing Authorization with the DS8900F and DS8A00 Hardware Management Console |
| CVE-2025-3624 | Missing Authorization Vulnerability in Hitachi Ops Center Analyzer |
| CVE-2025-36361 | IBM App Connect Enterprise runtime is vulnerable to a lack of authorization on windows environments using IWA |
| CVE-2025-36367 | IBM i is affected by a privilege escalation in IBM i SQL services |
| CVE-2025-36756 | Device Takeover vulnerability in SolaX Cloud |
| CVE-2025-3687 | misstt123 oasys Sticky Notes cross-site request forgery |
| CVE-2025-3701 | WordPress Malcure Malware Scanner plugin <= 16.8 - Broken Access Control vulnerability |
| CVE-2025-3702 | WordPress Melapress File Monitor plugin < 2.2.0 - Broken Access Control vulnerability |
| CVE-2025-3746 | OTP-less one tap Sign in 2.0.14 - 2.0.59 - Unauthenticated Arbitrary Email Update to Account Takeover/Privilege Escalation |
| CVE-2025-3766 | Login Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting |
| CVE-2025-3780 | WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorizatio... |
| CVE-2025-3808 | zhenfeng13 My-BBS cross-site request forgery |
| CVE-2025-3843 | panhainan DS-Java cross-site request forgery |
| CVE-2025-3863 | Post Carousel Slider for Elementor <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form... |
| CVE-2025-3871 | Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier |
| CVE-2025-3876 | SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCrea... |
| CVE-2025-3906 | Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalatio... |
| CVE-2025-3912 | WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.10.35 - Missing Authorization to Unauthenticated Sensitive... |
| CVE-2025-3915 | Aeropage Sync for Airtable <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion |
| CVE-2025-39350 | WordPress wProject theme < 5.8.0 - Unauthenticated Post/Comment/Attachment Modification/Deletion vulnerability |
| CVE-2025-39352 | WordPress Grand Restaurant WordPress theme <= 7.0 - Arbitrary Options Deletion vulnerability |
| CVE-2025-39353 | WordPress Grand Restaurant WordPress theme <= 7.0 - Broken Access Control vulnerability |
| CVE-2025-39362 | WordPress Mollie Payments for WooCommerce plugin <= 8.0.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-39367 | WordPress Kleo theme < 5.4.4 - Broken Access Control vulnerability |
| CVE-2025-39368 | WordPress Rootspersona plugin <= 3.7.5 - Broken Access Control vulnerability |
| CVE-2025-39373 | WordPress JNews Theme <= 11.6.16 - Broken Access Control Vulnerability |
| CVE-2025-39376 | WordPress Car Park Booking System for WordPress plugin <= 2.6 - Broken Access Control vulnerability |
| CVE-2025-39385 | WordPress Sirat theme <= 1.5.1 - Broken Access Control vulnerability |
| CVE-2025-39388 | WordPress AnalyticsWP plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2025-39390 | WordPress Booking and Rental Manager plugin <= 2.3.6 - Broken Access Control vulnerability |
| CVE-2025-39398 | WordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue theme <= 4.2.2 - Broken Access Control vulnerability |
| CVE-2025-39412 | WordPress Master Slider plugin <= 3.11.0 - Broken Access Control vulnerability |
| CVE-2025-39413 | WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin <= 3.6.0 - Broken Access Control vulnerability |
| CVE-2025-39552 | WordPress Zephyr Project Manager plugin <= 3.3.200 - Broken Access Control Vulnerability |
| CVE-2025-39553 | WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability |
| CVE-2025-39554 | WordPress AI Text to Speech plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2025-39559 | WordPress Bring Fraktguiden for WooCommerce plugin <= 1.11.4 - Broken Access Control vulnerability |
| CVE-2025-39560 | WordPress Live Forms plugin <= 4.8.4 - Broken Access Control vulnerability |
| CVE-2025-39561 | WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Broken Access Control vulnerability |
| CVE-2025-39571 | WordPress WowStore plugin <= 4.2.4 - Broken Access Control Vulnerability |
| CVE-2025-39580 | WordPress Dashi plugin <= 3.1.8 - Broken Access Control Vulnerability |
| CVE-2025-39583 | WordPress BERTHA AI plugin <= 1.12.10.2 - Arbitrary Content Deletion Vulnerability |
| CVE-2025-3959 | withstars Books-Management-System reader_delete.html cross-site request forgery |
| CVE-2025-39591 | WordPress WP Subscription Forms plugin <= 1.2.3 - Broken Access Control Vulnerability |
| CVE-2025-3960 | withstars Books-Management-System Background Interface allreaders.html authorization |
| CVE-2025-39602 | WordPress WooCommerce Product Table Lite plugin <= 3.9.5 - Broken Access Control vulnerability |
| CVE-2025-3963 | withstars Books-Management-System Background Interface list authorization |
| CVE-2025-3964 | withstars Books-Management-System Article del cross-site request forgery |
| CVE-2025-3979 | dazhouda lecms Password Change index.php cross-site request forgery |
| CVE-2025-4520 | Uncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update |
| CVE-2025-4522 | IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_pos... |
| CVE-2025-46348 | YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download |
| CVE-2025-46434 | WordPress The Plus Addons for Elementor Pro plugin < 6.3.7 - Broken Access Control vulnerability |
| CVE-2025-46470 | WordPress Smart Hashtags [#hashtagger] plugin <= 7.2.3 - Broken Access Control Vulnerability |
| CVE-2025-46485 | WordPress WP Customize Login Page plugin <= 1.6.5 - Broken Access Control Vulnerability |
| CVE-2025-46488 | WordPress Visual Builder plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2025-46489 | WordPress Bulk Assign Linked Products For WooCommerce plugin <= 2.1 - Broken Access Control Vulnerability |
| CVE-2025-46519 | WordPress Media Library Downloader plugin <= 1.3.1 - Broken Access Control Vulnerability |
| CVE-2025-46535 | WordPress Custom Login and Registration plugin <= 1.0.0 - Broken Access Control vulnerability |
| CVE-2025-46554 | XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API |
| CVE-2025-46557 | Any user with view access to the XWiki space can change the authenticator |
| CVE-2025-47580 | WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerability |
| CVE-2025-47585 | WordPress Booking and Rental Manager plugin <= 2.3.8 - Broken Access Control vulnerability |
| CVE-2025-47591 | WordPress Bulk Featured Image plugin <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2025-47601 | WordPress MaxiBlocks plugin <= 2.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2025-47602 | WordPress Calculate Prices based on Distance For WooCommerce plugin <= 1.3.5 - Broken Access Control vulnerability |
| CVE-2025-47612 | WordPress ClickWhale plugin <= 2.4.6 - Broken Access Control Vulnerability |
| CVE-2025-47619 | WordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerability |
| CVE-2025-47628 | WordPress QS Dark Mode plugin <= 3.0 - Broken Access Control Vulnerability |
| CVE-2025-47634 | WordPress WC Pickup Store plugin <= 1.8.9 - Settings Change Vulnerability |
| CVE-2025-47688 | WordPress Advanced File Manager plugin <= 5.3.1 - Broken Access Control to Notice Dismissal vulnerability |
| CVE-2025-47690 | WordPress Lead Form Data Collection to CRM plugin <= 3.1 - Arbitrary Option Update to Privilege Escalation vulnerability |
| CVE-2025-47692 | WordPress ContentStudio plugin <= 1.3.5 - Broken Access Control Vulnerability |
| CVE-2025-47709 | Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055 |
| CVE-2025-47942 | Learners on edX Platform can download python_lib.zip |
| CVE-2025-48009 | Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060 |
| CVE-2025-48013 | Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065 |
| CVE-2025-48079 | WordPress ProfileGrid plugin <= 5.9.5.1 - Broken Access Control Vulnerability |
| CVE-2025-48096 | WordPress Custom CSS plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2025-48108 | WordPress School Management Plugin <= 93.2.0 - Broken Access Control Vulnerability |
| CVE-2025-48116 | WordPress EventON plugin <= 2.4.4 - Broken Access Control Vulnerability |
| CVE-2025-48117 | WordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control Vulnerability |
| CVE-2025-48127 | WordPress Push notification for Mobile and Web app plugin <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2025-48128 | WordPress Sharespine Woocommerce Connector plugin <= 4.7.55 - Broken Access Control Vulnerability |
| CVE-2025-3952 | Projectopia – WordPress Project Management <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary O... |
| CVE-2025-39522 | WordPress Dynamic Post plugin <= 5.03 - Settings Change vulnerability |
| CVE-2025-3953 | WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subsc... |
| CVE-2025-39531 | WordPress Slazzer Background Changer plugin <= 3.14 - Broken Access Control Vulnerability |
| CVE-2025-39532 | WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability |
| CVE-2025-39533 | WordPress Starfish Review Generation & Marketing plugin <= 3.1.19 - Privilege Escalation vulnerability |
| CVE-2025-39536 | WordPress JobHunt Job Alerts <= 3.6 - Arbitrary Content Deletion Vulnerability |
| CVE-2025-39541 | WordPress WP Simple Booking Calendar plugin <= 2.0.13 - Broken Access Control vulnerability |
| CVE-2025-39545 | WordPress REST API Authentication plugin <= 3.6.3 - Settings Change Vulnerability |
| CVE-2025-3997 | dazhouda lecms Personal Information Page index.php cross-site request forgery |
| CVE-2025-4046 | Missing Authorization in Lexmark Cloud Services badge management |
| CVE-2025-4047 | Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View |
| CVE-2025-40602 | A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management co... |
| CVE-2025-40667 | Missing authorization vulnerability in TCMAN GIM v11 |
| CVE-2025-40673 | Missing Authorization in DinoRANK |
| CVE-2025-40837 | Ericsson Indoor Connect 8855 - Missing Authorization Vulnerability |
| CVE-2025-4095 | Registry Access Management (RAM) policies not applied when sign-in enforcement is configured via a configuration profile |
| CVE-2025-41012 | Unauthorized access vulnerability in TCMAN GIM |
| CVE-2025-41016 | Multiple vulnerabilities in DFUSION by Davantis |
| CVE-2025-41017 | Multiple vulnerabilities in DFUSION by Davantis |
| CVE-2025-4105 | Splitit <= 4.2.8 - Missing Authorization to Multiple Administrative Actions |
| CVE-2025-41111 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41112 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41113 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41114 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41335 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41336 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41337 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41338 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41339 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41340 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41341 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41342 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41343 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41344 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41345 | Missing Authorization vulnerability in CanalDenuncia.app |
| CVE-2025-41410 | Slack import bypasses email verification for team access controls |
| CVE-2025-41443 | Guest user can discover active public channels |
| CVE-2025-41764 | Unchecked role in wwwupdate.cgi |
| CVE-2025-41765 | Unchecked role in wwwupload.cgi |
| CVE-2025-4177 | Flynax Bridge <= 2.2.0 - Unauthenticated Arbitrary User Deletion |
| CVE-2025-4179 | Flynax Bridge <= 2.2.0 - Unauthenticated Limited Privilege Escalation |
| CVE-2025-4202 | Multicollab: Content Team Collaboration and Editorial Workflow <= 5.2 - Missing Authorization to Authenticated (Subscriber+)... |
| CVE-2025-42949 | Missing Authorization check in ABAP Platform |
| CVE-2025-42952 | Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis |
| CVE-2025-42953 | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2025-42955 | Missing authorization check in SAP Cloud Connector |
| CVE-2025-42960 | Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA BEx Tools |
| CVE-2025-42961 | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2025-42968 | Missing Authorization check in SAP NetWeaver (RFC enabled function module) |
| CVE-2025-42974 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) |
| CVE-2025-42982 | Information Disclosure in SAP GRC (AC Plugin) |
| CVE-2025-42983 | Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis |
| CVE-2025-42984 | Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application) |
| CVE-2025-42986 | Missing Authorization check in SAP NetWeaver and ABAP Platform |
| CVE-2025-42987 | Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement) |
| CVE-2025-42989 | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2025-42991 | Missing Authorization check in SAP S/4HANA (Bank Account Application) |
| CVE-2025-42993 | Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement) |
| CVE-2025-43000 | Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW) |
| CVE-2025-43004 | Security Misconfiguration Vulnerability in SAP Digital Manufacturing (Production Operator Dashboard) |
| CVE-2025-43007 | Missing Authorization check in SAP Service Parts Management (SPM) |
| CVE-2025-43008 | Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal |
| CVE-2025-43009 | Missing Authorization check in SAP Service Parts Management (SPM) |
| CVE-2025-43011 | Missing Authorization Check in SAP Landscape Transformation (PCL Basis) |
| CVE-2025-49268 | WordPress Verge3D plugin <= 4.9.4 - Broken Access Control Vulnerability |
| CVE-2025-49270 | WordPress WP-CRM System plugin <= 3.4.2 - Broken Access Control Vulnerability |
| CVE-2025-49272 | WordPress Trinity Audio plugin <= 5.20.0 - Broken Access Control Vulnerability |
| CVE-2025-49287 | WordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control Vulnerability |
| CVE-2025-49288 | WordPress Ultimate WP Mail plugin <= 1.3.5 - Account Takeover via Email Log Leak Vulnerability |
| CVE-2025-49289 | WordPress PDF for WPForms plugin <= 5.5.0 - Broken Access Control Vulnerability |
| CVE-2025-32221 | WordPress EazyDocs plugin <= 2.7.1 - Broken Access Control vulnerability |
| CVE-2025-32224 | WordPress Privyr CRM plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2025-32225 | WordPress WP Event Manager plugin <= 3.2.0 - Broken Access Control vulnerability |
| CVE-2025-32226 | WordPress Display product variations dropdown on shop page plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2025-32229 | WordPress Variable Inspector plugin <= 2.6.3 - Broken Access Control vulnerability |
| CVE-2025-32231 | WordPress Bookingor plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2025-32232 | WordPress StaffList plugin <= 3.2.7 - Broken Access Control vulnerability |
| CVE-2025-32233 | WordPress Revive.so plugin <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2025-32234 | WordPress AdMail plugin <= 1.7.0 - Broken Access Control vulnerability |
| CVE-2025-32235 | WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.9.4 - Broken Access Control vulnerabi... |
| CVE-2025-41698 | Draeger: ICMHelper is vulnerable to a privilege escalation due too missing authorization |
| CVE-2025-4282 | SourceCodester/oretnom23 Stock Management System Users.php cross-site request forgery |
| CVE-2025-42882 | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2025-42891 | Missing Authorization check in SAP Enterprise Search for ABAP |
| CVE-2025-42899 | Missing Authorization check in SAP S4CORE (Manage Journal Entries) |
| CVE-2025-42911 | Missing Authorization check in SAP NetWeaver (Service Data Download) |
| CVE-2025-42912 | Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application) |
| CVE-2025-42913 | Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application) |
| CVE-2025-42914 | Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application) |
| CVE-2025-42915 | Missing Authorization Check in Fiori app (Manage Payment Blocks) |
| CVE-2025-42917 | Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application) |
| CVE-2025-42918 | Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing) |
| CVE-2025-4327 | MRCMS cross-site request forgery |
| CVE-2025-4339 | TheGem <= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options Update |
| CVE-2025-4370 | Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload |
| CVE-2025-43773 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7... |
| CVE-2025-43788 | The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 upd... |
| CVE-2025-43805 | Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and... |
| CVE-2025-43838 | WordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change Vulnerability |
| CVE-2025-43862 | Dify Allows Unauthorized Access and Modification of APP Orchestration |
| CVE-2025-44001 | Unauthorized Channel Subscription Read in Mattermost Confluence Plugin |
| CVE-2025-4430 | Unauthorized file manipulation in EZD RP |
| CVE-2025-4477 | TeamT5 ThreatSonar Anti-Ransomware - Privilege Escalation |
| CVE-2025-4571 | GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign D... |
| CVE-2025-45854 | /server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams. |
| CVE-2025-4597 | Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbi... |
| CVE-2025-46232 | WordPress Download Alt Text AI plugin <= 1.9.93 - Broken Access Control Vulnerability |
| CVE-2025-46244 | WordPress Advanced Linked Variations for Woocommerce plugin <= 1.0.3 - Broken Access Control Vulnerability |
| CVE-2025-46247 | WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability |
| CVE-2025-46255 | WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Settings Change vulnerability |
| CVE-2025-46258 | WordPress Element Pack Pro Plugin < 8.0.0 - Broken Access Control vulnerability |
| CVE-2025-46259 | WordPress The Plus Addons for Elementor - Pro Plugin < 6.3.7 - Broken Access Control vulnerability |
| CVE-2025-46586 | Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect avai... |
| CVE-2025-46745 | Improper Privilege Management |
| CVE-2025-46811 | SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint |
| CVE-2025-46823 | OpenMRS has Vulnerability in FHIR2 Module Privileges |
| CVE-2025-4683 | MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) P... |
| CVE-2025-47444 | WordPress FiboSearch plugin <= 1.32.1 - Broken Access Control vulnerability |
| CVE-2025-47450 | WordPress Simple File List plugin <= 6.1.13 - Settings Change Vulnerability |
| CVE-2025-47457 | WordPress LocateAndFilter plugin <= 1.6.16 - Broken Access Control Vulnerability |
| CVE-2025-47463 | WordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control Vulnerability |
| CVE-2025-47465 | WordPress Blocksy theme <= 2.0.97 - Broken Access Control Vulnerability |
| CVE-2025-47467 | WordPress GS Testimonial Slider plugin <= 3.3.0 - Broken Access Control Vulnerability |
| CVE-2025-47469 | WordPress Media Hygiene plugin <= 4.0.0 - Broken Access Control Vulnerability |
| CVE-2025-47471 | WordPress Envo Extra plugin <= 1.9.9 - Broken Access Control Vulnerability |
| CVE-2025-47472 | WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control Vulnerability |
| CVE-2025-47480 | WordPress Graphina plugin <= 3.0.4 - Broken Access Control Vulnerability |
| CVE-2025-47485 | WordPress Cozy Blocks plugin <= 2.1.22 - Broken Access Control Vulnerability |
| CVE-2025-47486 | WordPress Gutenberg & Elementor Templates Importer For Responsive plugin <= 3.1.9 - Broken Access Control Vulnerability |
| CVE-2025-47526 | WordPress GS Variation Swatches for WooCommerce plugin <= 3.0.4 - Broken Access Control Vulnerability |
| CVE-2025-47527 | WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerabilit... |
| CVE-2025-47528 | WordPress Ovation Elements plugin <= 1.1.2 - Broken Access Control Vulnerability |
| CVE-2025-47529 | WordPress Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Settings Change Vulnerability |
| CVE-2025-47534 | WordPress Wordpress Auto Spinner plugin <= 3.25.0 - Broken Access Control Vulnerability |
| CVE-2025-47556 | WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Broken Access Control Vulnerability |
| CVE-2025-47558 | WordPress MapSVG plugin < 8.6.13 - Broken Access Control vulnerability |
| CVE-2025-47560 | WordPress MapSVG plugin < 8.6.13 - Broken Access Control Vulnerability |
| CVE-2025-47563 | WordPress CURCY plugin <= 2.3.7 - Arbitrary Shortcode Execution vulnerability |
| CVE-2025-47564 | WordPress EventON plugin <= 4.9.8 - Broken Access Control vulnerability |
| CVE-2025-47565 | WordPress EventON plugin <= 4.9.9 - Broken Access Control vulnerability |
| CVE-2025-5117 | Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role... |
| CVE-2025-48133 | WordPress Uncanny Automator plugin <= 6.4.0.2 - Broken Access Control Vulnerability |
| CVE-2025-48138 | WordPress BERTHA AI plugin <= 1.13 - Broken Access Control Vulnerability |
| CVE-2025-48139 | WordPress StyleAI plugin <= 1.0.4 - Broken Access Control Vulnerability |
| CVE-2025-48147 | WordPress CryptoCloud - Crypto Payment Gateway plugin <= 2.1.2 - Broken Access Control vulnerability |
| CVE-2025-48150 | WordPress Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin plugin <= 4.48 - Broken Access Control Vu... |
| CVE-2025-48155 | WordPress Residential Address Detection plugin <= 2.5.9 - Broken Access Control Vulnerability |
| CVE-2025-48166 | WordPress Stop and Block bots plugin Anti bots <= 1.48 - Broken Access Control Vulnerability |
| CVE-2025-48167 | WordPress Chatbox Manager plugin <= 1.2.5 - Broken Access Control Vulnerability |
| CVE-2025-48242 | WordPress Legal Pages plugin <= 1.4.5 - Broken Access Control Vulnerability |
| CVE-2025-48246 | WordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control Vulnerability |
| CVE-2025-48247 | WordPress Shortlinks by Pretty Links plugin <= 3.6.15 - Broken Access Control Vulnerability |
| CVE-2025-48257 | WordPress Projectopia plugin <= 5.1.17 - Broken Access Control Vulnerability |
| CVE-2025-48260 | WordPress GDPR CCPA Compliance Support plugin <= 2.7.3 - Broken Access Control Vulnerability |
| CVE-2025-48262 | WordPress Url Rewrite Analyzer plugin <= 1.3.3 - Broken Access Control Vulnerability |
| CVE-2025-48268 | WordPress Bot for Telegram on WooCommerce plugin <= 1.2.6 - Broken Access Control Vulnerability |
| CVE-2025-48271 | WordPress Leadinfo plugin <= 1.1 - Settings Change Vulnerability |
| CVE-2025-48272 | WordPress WP Job Portal plugin <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-48275 | WordPress Visual Header plugin <= 1.3 - Broken Access Control Vulnerability |
| CVE-2025-48282 | WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control Vulnerability |
| CVE-2025-48326 | WordPress Acclectic Media Organizer Plugin <= 1.4 - Broken Access Control Vulnerability |
| CVE-2025-48327 | WordPress WP Mailgun SMTP plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2025-48334 | WordPress Woo Slider Pro <= 1.12 - Arbitrary Content Deletion Vulnerability |
| CVE-2025-48335 | WordPress Responsive Plus plugin <= 3.2.0 - Broken Access Control vulnerability |
| CVE-2025-48337 | WordPress QuickCab plugin <= 1.3.3 - Broken Access Control vulnerability |
| CVE-2025-48339 | WordPress Profiler - What Slowing Down Your WP <= 1.0.0 - Broken Access Control Vulnerability |
| CVE-2025-48346 | WordPress Embed and Integrate Etsy Shop plugin <= 1.0.8 - Broken Access Control vulnerability |
| CVE-2025-48350 | WordPress AutoWP plugin <= 2.2.7 - Broken Access Control vulnerability |
| CVE-2025-48444 | Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064 |
| CVE-2025-48731 | Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin |
| CVE-2025-48784 | Soar Cloud HRD Human Resource Management System - Missing Authorization |
| CVE-2025-4887 | SourceCodester Online Student Clearance System cross-site request forgery |
| CVE-2025-48878 | Combodo iTop vulnerable to IDOR with ModuleInstallation object |
| CVE-2025-48916 | Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070 |
| CVE-2025-48998 | Dataease MYSQL JDBC File Reading Vulnerability |
| CVE-2025-49041 | WordPress Get Cash plugin <= 3.2.3 - Broken Access Control vulnerability |
| CVE-2025-49052 | WordPress Netease Music plugin <= 3.2.1 - Broken Access Control vulnerability |
| CVE-2025-49181 | Configurations endpoint does not require authorization |
| CVE-2025-49221 | Unauthenticated Access to Channel Subscription in Mattermost Confluence Plugin |
| CVE-2025-49234 | WordPress WP Dummy Content Generator plugin <= 3.4.6 - Arbitrary User Deletion vulnerability |
| CVE-2025-49236 | WordPress Raychat plugin <= 2.1.0 - Broken Access Control Vulnerability |
| CVE-2025-49240 | WordPress DocsPress plugin <= 2.5.2 - Broken Access Control Vulnerability |
| CVE-2025-49241 | WordPress oik plugin <= 4.15.1 - Broken Access Control Vulnerability |
| CVE-2025-49246 | WordPress Testimonials Showcase plugin <= 1.9.16 - Broken Access Control Vulnerability |
| CVE-2025-49248 | WordPress Team Showcase plugin < 25.05.13 - Broken Access Control Vulnerability |
| CVE-2025-49265 | WordPress Membership For WooCommerce plugin <= 2.8.1 - Broken Access Control Vulnerability |
| CVE-2025-49406 | WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerability |
| CVE-2025-49431 | WordPress MF Plus WPML plugin <= 1.1 - Settings Change Vulnerability |
| CVE-2025-49432 | WordPress Ultimate Video Player Plugin <= 10.1 - Broken Access Control Vulnerability |
| CVE-2025-49441 | WordPress Interactive Regional Map of Florida plugin <= 1.0 - Broken Access Control Vulnerability |
| CVE-2025-49459 | Zoom Workplace for Windows on ARM - Missing Authorization |
| CVE-2025-49509 | WordPress Audio Editor & Recorder plugin <= 2.2.1 - Broken Access Control vulnerability |
| CVE-2025-49651 | Missing Authorization for Interactive Sessions |
| CVE-2025-49723 | Windows StateRepository API Server file Tampering Vulnerability |
| CVE-2025-49747 | Azure Machine Learning Elevation of Privilege Vulnerability |
| CVE-2025-49829 | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations |
| CVE-2025-49857 | WordPress myCred plugin <= 2.9.4.2 - Broken Access Control Vulnerability |
| CVE-2025-49860 | WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control vulnerability |
| CVE-2025-49864 | WordPress AFS Analytics plugin <= 4.21 - Broken Access Control Vulnerability |
| CVE-2025-49872 | WordPress myCred plugin <= 2.9.4.2 - Broken Access Control Vulnerability |
| CVE-2025-49874 | WordPress Arconix FAQ plugin <= 1.9.6 - Broken Access Control Vulnerability |
| CVE-2025-49880 | WordPress CubeWP Forms plugin <= 1.1.5 - Broken Access Control Vulnerability |
| CVE-2025-49884 | WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability |
| CVE-2025-49888 | WordPress PW WooCommerce On Sale! plugin <= 1.39 - Broken Access Control Vulnerability |
| CVE-2025-49899 | WordPress Whydonate plugin <= 4.0.15 - Broken Access Control vulnerability |
| CVE-2025-49902 | WordPress Login Page Customizer – Customizer Login Page, Admin Page, Custom Design plugin <= 2.1.1 - Broken Access Control vu... |
| CVE-2025-49903 | WordPress ZoloBlocks plugin <= 2.3.11 - Broken Access Control vulnerability |
| CVE-2025-49906 | WordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerability |
| CVE-2025-49907 | WordPress MDTF plugin <= 1.3.3.9 - Broken Access Control vulnerability |
| CVE-2025-49910 | WordPress WPGuppy plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2025-49913 | WordPress CoSchedule plugin <= 3.4.0 - Broken Access Control vulnerability |
| CVE-2025-49916 | WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability |
| CVE-2025-49920 | WordPress Web Accessibility By accessiBe plugin <= 2.10 - Broken Access Control vulnerability |
| CVE-2025-49922 | WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.3 - Broken Access Control vulnerability |
| CVE-2025-49925 | WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability |
| CVE-2025-49937 | WordPress Smash Balloon Social Post Feed plugin <= 4.3.2 - Broken Access Control vulnerability |
| CVE-2025-49949 | WordPress Templazee plugin <= 1.0.2 - Broken Access Control Vulnerability |
| CVE-2025-49950 | WordPress Official Integration for Billingo plugin <= 4.3.0 - Privilege Escalation vulnerability |
| CVE-2025-49961 | WordPress Breeze Checkout plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2025-49969 | WordPress Zara 4 Image Compression plugin <= 1.2.17.2 - Broken Access Control Vulnerability |
| CVE-2025-49970 | WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability |
| CVE-2025-49971 | WordPress eDS Responsive Menu plugin <= 1.2 - Broken Access Control Vulnerability |
| CVE-2025-49973 | WordPress Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes plugin <= 1.0.10 - Broken Access Control Vul... |
| CVE-2025-49974 | WordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.1 - Broken Access Control Vulnerability |
| CVE-2025-53421 | WordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerability |
| CVE-2025-53424 | WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - Broken Access Control vulnerability |
| CVE-2025-49293 | WordPress Crawlomatic Multisite Scraper Post Generator plugin <= 2.6.8.2 - Broken Access Control Vulnerability |
| CVE-2025-49319 | WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control Vulnerability |
| CVE-2025-49320 | WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.11 - Broken Access Control Vulnerability |
| CVE-2025-49324 | WordPress Job Board Manager plugin <= 2.1.60 - Broken Access Control Vulnerability |
| CVE-2025-49338 | WordPress Flowbox plugin <= 1.1.6 - Broken Access Control vulnerability |
| CVE-2025-49339 | WordPress Direct Payments WP plugin <= 1.3.2 - Broken Access Control vulnerability |
| CVE-2025-49348 | WordPress Hype plugin <= 1.0.5 - Broken Access Control vulnerability |
| CVE-2025-49349 | WordPress Reuters Direct plugin <= 3.0.0 - Broken Access Control vulnerability |
| CVE-2025-49350 | WordPress Actionwear products sync plugin <= 2.3.3 - Broken Access Control vulnerability |
| CVE-2025-49356 | WordPress Orders Chat for WooCommerce plugin <= 1.2.0 - Broken Access Control vulnerability |
| CVE-2025-49375 | WordPress HomeLancer theme <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-49376 | WordPress DELUCKS SEO plugin <= 2.5.9 - Broken Access Control vulnerability |
| CVE-2025-49377 | WordPress Hydra Booking plugin <= 1.1.9 - Broken Access Control vulnerability |
| CVE-2025-49394 | WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnera... |
| CVE-2025-49396 | WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerability |
| CVE-2025-49402 | WordPress Exertio Framework Plugin <= 1.3.3 - SQL Injection Vulnerability |
| CVE-2025-49976 | WordPress WANotifier plugin <= 2.7.12 - Broken Access Control vulnerability |
| CVE-2025-49979 | WordPress Media Hygiene plugin <= 4.0.1 - Broken Access Control vulnerability |
| CVE-2025-49980 | WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability |
| CVE-2025-49981 | WordPress User Roles and Capabilities plugin <= 1.2.6 - Broken Access Control Vulnerability |
| CVE-2025-49982 | WordPress WP Customer Area plugin <= 8.3.4 - Broken Access Control vulnerability |
| CVE-2025-49986 | WordPress Video List Manager plugin <= 1.7 - Broken Access Control Vulnerability |
| CVE-2025-49987 | WordPress CRM ERP Business Solution plugin <= 1.13 - Broken Access Control Vulnerability |
| CVE-2025-49988 | WordPress Contact Form 7 AWeber Extension plugin <= 0.1.40 - Broken Access Control vulnerability |
| CVE-2025-49989 | WordPress App Builder plugin <= 5.5.6 - Broken Access Control vulnerability |
| CVE-2025-49990 | WordPress ContentStudio plugin <= 1.3.7 - Broken Access Control vulnerability |
| CVE-2025-49991 | WordPress WP-Recall plugin <= 16.26.14 - Broken Access Control Vulnerability |
| CVE-2025-49993 | WordPress Cookie-Script.com plugin <= 1.2.1 - Broken Access Control Vulnerability |
| CVE-2025-49996 | WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.4 - Broken Access Control vulnerability |
| CVE-2025-49997 | WordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF Vulnerability |
| CVE-2025-49998 | WordPress WooCommerce Fortnox Integration plugin <= 4.5.5 - Broken Access Control Vulnerability |
| CVE-2025-50008 | WordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin <= 1.2.4.5... |
| CVE-2025-50009 | WordPress Kata Plus plugin <= 1.5.3 - Broken Access Control Vulnerability |
| CVE-2025-50010 | WordPress Zapier for WordPress plugin <= 1.5.2 - Broken Access Control Vulnerability |
| CVE-2025-50028 | WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability |
| CVE-2025-50029 | WordPress AI Tools <= 4.0.7 - Arbitrary Content Deletion Vulnerability |
| CVE-2025-50031 | WordPress DB Backup <= 6.0 - Broken Access Control Vulnerability |
| CVE-2025-50032 | WordPress Paytiko for WooCommerce plugin <= 1.3.21 - Broken Access Control vulnerability |
| CVE-2025-50034 | WordPress Enhanced Blocks – Page Builder Blocks for Gutenberg plugin <= 1.4.1 - Broken Access Control Vulnerability |
| CVE-2025-50039 | WordPress VG WORT METIS plugin <= 2.0.1 - Broken Access Control Vulnerability |
| CVE-2025-50171 | Remote Desktop Spoofing Vulnerability |
| CVE-2025-5018 | Hive Support <= 1.2.5 - Authenticated (Subscriber+) Missing Authorization via hs_update_ai_chat_settings and hive_lite_suppor... |
| CVE-2025-5033 | XiaoBingby TeaCMS addUser cross-site request forgery |
| CVE-2025-5185 | Summer Pearl Group Vacation Rental Management Platform cross-site request forgery |
| CVE-2025-52775 | WordPress Project Cost Calculator Plugin <= 1.0.0 - Broken Access Control Vulnerability |
| CVE-2025-52785 | WordPress SMM API plugin <= 6.0.31 - Broken Access Control vulnerability |
| CVE-2025-52800 | WordPress The E-Commerce ERP <= 2.1.1.3 - Broken Access Control Vulnerability |
| CVE-2025-52801 | WordPress TheBooking Plugin <= 1.4.4 - Broken Access Control Vulnerability |
| CVE-2025-52802 | WordPress Import YouTube videos as WP Posts plugin <= 2.1 - Broken Access Control Vulnerability |
| CVE-2025-52803 | WordPress Sala theme <= 1.1.3 - Broken Access Control Vulnerability |
| CVE-2025-52804 | WordPress Nuss theme <= 1.3.7.1 - Broken Access Control Vulnerability |
| CVE-2025-52813 | WordPress MobiLoud <= 4.6.5 - Broken Access Control Vulnerability |
| CVE-2025-52817 | WordPress Abandoned Contact Form 7 plugin <= 2.2 - Broken Access Control vulnerability |
| CVE-2025-52818 | WordPress Trusty Whistleblowing plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2025-5282 | WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion |
| CVE-2025-5121 | Missing Authorization in GitLab |
| CVE-2025-5132 | Tmall Demo logout cross-site request forgery |
| CVE-2025-52554 | n8n Improper Authorization in Workflow Execution Stop Endpoint Allows Terminating Other Users’ Workflows |
| CVE-2025-52721 | WordPress Global Gallery Plugin <= 9.2.3 - Broken Access Control Vulnerability |
| CVE-2025-52731 | WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Arbitrary Content Deletion Vulnerabil... |
| CVE-2025-52738 | WordPress Wikipedia Preview plugin <= 1.15.0 - Broken Access Control vulnerability |
| CVE-2025-52757 | WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Arbitrary Content Deletion vulnerability |
| CVE-2025-52766 | WordPress Printeers Print & Ship plugin <= 1.17.0 - Broken Access Control vulnerability |
| CVE-2025-52950 | Juniper Security Director: Insufficient authorization for multiple endpoints in web interface |
| CVE-2025-52954 | Junos OS Evolved: A low-privileged user can execute arbitrary Junos commands and modify the configuration, thereby compromisi... |
| CVE-2025-5304 | PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add... |
| CVE-2025-53108 | HomeBox Missing User Authorization |
| CVE-2025-53111 | GLPI exposes data to non-allowed users |
| CVE-2025-53112 | GLPI's incomprehensive permission checks can lead to data removal from allowed users |
| CVE-2025-53113 | GLPI technicians can access unauthorized information through external links |
| CVE-2025-5315 | Missing Authorization in GitLab |
| CVE-2025-5317 | Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac |
| CVE-2025-53200 | WordPress ChatBot plugin <= 6.7.3 - Broken Access Control Vulnerability |
| CVE-2025-53214 | WordPress Sertifier Certificate & Badge Maker plugin <= 1.21 - Broken Access Control Vulnerability |
| CVE-2025-53217 | WordPress AIO WP Builder Plugin <= 2.0.2 - Broken Access Control Vulnerability |
| CVE-2025-53221 | WordPress CodeablePress plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2025-53230 | WordPress Page Manager for Elementor Plugin <= 2.0.5 - Broken Access Control Vulnerability |
| CVE-2025-53236 | WordPress UDesign Core plugin <= 4.14.0 - Broken Access Control vulnerability |
| CVE-2025-53246 | WordPress Backup and Move Plugin <= 0.1 - Broken Access Control Vulnerability |
| CVE-2025-53255 | WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control Vulnerability |
| CVE-2025-53266 | WordPress Cron Logger plugin <= 1.3.0 - Broken Access Control Vulnerability |
| CVE-2025-53284 | WordPress CMS Blocks plugin <= 1.1 - Broken Access Control Vulnerability |
| CVE-2025-53288 | WordPress PlatiOnline Payments plugin <= 7.0.0 - Broken Access Control vulnerability |
| CVE-2025-53291 | WordPress Spreadconnect plugin <= 2.1.5 - Broken Access Control Vulnerability |
| CVE-2025-53293 | WordPress Dashboard Widget Sidebar plugin <= 1.2.3 - Broken Access Control Vulnerability |
| CVE-2025-53295 | WordPress iCount Payment Gateway plugin <= 2.0.7 - Broken Access Control Vulnerability |
| CVE-2025-53302 | WordPress Constructor theme <= 1.6.5 - Broken Access Control Vulnerability |
| CVE-2025-53304 | WordPress Contact Form – 7 : Hide Success Message plugin <= 1.1.4 - Broken Access Control Vulnerability |
| CVE-2025-53318 | WordPress WP DB Booster plugin <= 1.0.1 - Broken Access Control Vulnerability |
| CVE-2025-53323 | WordPress Pre-Publish Post Checklist plugin <= 3.1 - Broken Access Control Vulnerability |
| CVE-2025-53337 | WordPress LifePress plugin <= 2.1.3 - Broken Access Control vulnerability |
| CVE-2025-53340 | WordPress Awesome Support plugin <= 6.3.6 - Sensitive Data Exposure vulnerability |
| CVE-2025-53341 | WordPress Stratus theme <= 4.2.5 - Broken Access Control vulnerability |
| CVE-2025-53343 | WordPress Modernize Theme <= 3.4.0 - Broken Access Control Vulnerability |
| CVE-2025-53345 | WordPress Thim Core plugin <= 2.3.3 - Arbitrary Plugin Installation vulnerability |
| CVE-2025-53346 | WordPress Thim Core Plugin <= 2.3.3 - Broken Access Control Vulnerability |
| CVE-2025-53348 | WordPress Kalium Theme <= 3.18.3 - Broken Access Control Vulnerability |
| CVE-2025-53374 | Dokploy Improperly Discloses User Information via user.one Endpoint |
| CVE-2025-53825 | Dokploy's Preview Deployments are vulnerable to Remote Code Execution |
| CVE-2025-53857 | Lack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence Plugin |
| CVE-2025-53910 | Unauthorized Channel Subscription Edit in Mattermost Confluence Plugin |
| CVE-2025-5410 | Mist Community Edition middleware.py session_start_response cross-site request forgery |
| CVE-2025-54159 | Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers t... |
| CVE-2025-54378 | HAX CMS Backend Lacks Comprehensive Authorization Checks |
| CVE-2025-54458 | Unauthorized Subscription Creation to Confluence Space in Mattermost Confluence Plugin |
| CVE-2025-54705 | WordPress WpEvently plugin <= 4.4.6 - Broken Access Control vulnerability |
| CVE-2025-54710 | WordPress Tiktok Feed Plugin <= 1.0.21 - Broken Access Control Vulnerability |
| CVE-2025-54711 | WordPress Info Cards Plugin <= 1.0.11 - Broken Access Control Vulnerability |
| CVE-2025-54712 | WordPress Easy Elementor Addons Plugin <= 2.2.7 - Broken Access Control Vulnerability |
| CVE-2025-54714 | WordPress Zephyr Project Manager Plugin <= 3.3.201 - Broken Access Control Vulnerability |
| CVE-2025-54717 | WordPress WP Membership Plugin <= 1.6.3 - Settings Change Vulnerability |
| CVE-2025-54730 | WordPress Embedder for Google Reviews Plugin <= 1.7.3 - Broken Access Control Vulnerability |
| CVE-2025-54733 | WordPress All Bootstrap Blocks Plugin <= 1.3.28 - Broken Access Control Vulnerability |
| CVE-2025-54734 | WordPress B Slider Plugin <= 1.1.30 - Broken Access Control Vulnerability |
| CVE-2025-54739 | WordPress Nexter Blocks Plugin <= 4.5.4 - Broken Access Control Vulnerability |
| CVE-2025-54741 | WordPress Super Blank Plugin <= 1.2.0 - Arbitrary Content Deletion Vulnerability |
| CVE-2025-54743 | WordPress Download After Email Plugin 2.1.5-2.1.6 - Other Vulnerability Type Vulnerability |
| CVE-2025-54744 | WordPress MasterStudy LMS plugin <= 3.6.15 - Broken Access Control vulnerability |
| CVE-2025-54745 | WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control Vulnerability |
| CVE-2025-54751 | WordPress PostX plugin <= 4.1.36 - Broken Access Control vulnerability |
| CVE-2025-5483 | LC Wizard 1.2.10 - 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation |
| CVE-2025-5486 | WP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password Reset |
| CVE-2025-5885 | Konica Minolta bizhub cross-site request forgery |
| CVE-2025-58877 | WordPress Javo Core plugin <= 3.0.0.529 - Arbitrary Content Deletion vulnerability |
| CVE-2025-5888 | jsnjfz WebStack-Guns cross-site request forgery |
| CVE-2025-58919 | WordPress Wide Banner plugin <= 1.0.4 - Broken Access Control vulnerability |
| CVE-2025-58938 | WordPress IDonatePro plugin <= 2.1.9 - Broken Access Control vulnerability |
| CVE-2025-53452 | WordPress Event Rocket Plugin <= 3.3 - Broken Access Control Vulnerability |
| CVE-2025-53485 | SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes |
| CVE-2025-53495 | Unauthorized Disclosure of IP Reputation in AbuseFilter |
| CVE-2025-53499 | Unauthorized Inspection of Protected Variables in AbuseFilter |
| CVE-2025-53571 | WordPress HAPPY plugin <= 1.0.6 - Broken Access Control vulnerability |
| CVE-2025-53640 | Indico vulnerable to user enumeration via API endpoint |
| CVE-2025-5394 | Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Up... |
| CVE-2025-53986 | WordPress Hestia theme <= 3.2.10 - Broken Access Control Vulnerability |
| CVE-2025-53997 | WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability |
| CVE-2025-53999 | WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability |
| CVE-2025-54002 | WordPress xSmart theme <= 1.2.9.4 - Broken Access Control vulnerability |
| CVE-2025-54004 | WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control vulnerability |
| CVE-2025-54005 | WordPress SKT Page Builder plugin <= 4.9 - Broken Access Control vulnerability |
| CVE-2025-54011 | WordPress SMTP2GO plugin <= 1.12.1 - Broken Access Control Vulnerability |
| CVE-2025-54018 | WordPress CM Pop-Up banners plugin <= 1.8.4 - Broken Access Control Vulnerability |
| CVE-2025-54025 | WordPress Coupon Affiliates Plugin <= 6.4.0 - Settings Change Vulnerability |
| CVE-2025-54037 | WordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control Vulnerability |
| CVE-2025-54040 | WordPress Webba Booking <= 5.1.20 - Broken Access Control Vulnerability |
| CVE-2025-54045 | WordPress CM On Demand Search And Replace plugin <= 1.5.5 - Broken Access Control vulnerability |
| CVE-2025-54047 | WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability |
| CVE-2025-54679 | WordPress Neon Channel Product Customizer Free Plugin <= 2.0 - Arbitrary Content Deletion Vulnerability |
| CVE-2025-54692 | WordPress Membership For WooCommerce Plugin <= 2.9.0 - Broken Access Control Vulnerability |
| CVE-2025-54695 | WordPress HT Mega Plugin plugin <= 2.9.0 - Broken Access Control Vulnerability |
| CVE-2025-54943 | SUNNET Corporate Training Management System - Missing Authorization |
| CVE-2025-55141 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Ga... |
| CVE-2025-55142 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Ga... |
| CVE-2025-55144 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Ga... |
| CVE-2025-55145 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Ga... |
| CVE-2025-55148 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Ga... |
| CVE-2025-5521 | WuKongOpenSource WukongCRM updataPassword cross-site request forgery |
| CVE-2025-5692 | Lead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actions |
| CVE-2025-5701 | HyperComments <= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Update |
| CVE-2025-5732 | code-projects Traffic Offense Reporting System cross-site request forgery |
| CVE-2025-57884 | WordPress Greenshift Plugin <= 12.1.1 - Broken Access Control Vulnerability |
| CVE-2025-57894 | WordPress WPPizza Plugin <= 3.19.8 - Broken Access Control Vulnerability |
| CVE-2025-57896 | WordPress Church Admin Plugin <= 5.0.26 - Broken Access Control Vulnerability |
| CVE-2025-57899 | WordPress WP Compress Plugin <= 6.50.54 - Broken Access Control Vulnerability |
| CVE-2025-57907 | WordPress Heureka Plugin <= 1.1.0 - Broken Access Control Vulnerability |
| CVE-2025-57909 | WordPress Editor Custom Color Palette plugin <= 3.5.6 - Broken Access Control vulnerability |
| CVE-2025-57917 | WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.8 - Broken Access Control vulnerability |
| CVE-2025-57921 | WordPress Frontend File Manager plugin <= 23.3 - Broken Access Control vulnerability |
| CVE-2025-57936 | WordPress Subresource Integrity (SRI) Manager Plugin <= 0.4.0 - Broken Access Control Vulnerability |
| CVE-2025-57939 | WordPress Image Hover Effects – Elementor Addon Plugin <= 1.4.4 - Broken Access Control Vulnerability |
| CVE-2025-57944 | WordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3 - Broken Access Control vulnerability |
| CVE-2025-57949 | WordPress Ongkoskirim.id Plugin <= 1.0.6 - Broken Access Control Vulnerability |
| CVE-2025-57955 | WordPress Post Carousel Slider for Elementor Plugin <= 1.7.0 - Broken Access Control Vulnerability |
| CVE-2025-57957 | WordPress WooMS Plugin <= 9.12 - Broken Access Control Vulnerability |
| CVE-2025-5814 | Profiler – What Slowing Down Your WP <= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via S... |
| CVE-2025-5815 | Traffic Monitor <= 3.2.2 - Missing Authorization to Unauthenticated Settings Update |
| CVE-2025-5816 | Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship <= 3.2.0 - Insecure Direct Object Reference to Authenti... |
| CVE-2025-58192 | WordPress WP Bulk Delete Plugin <= 1.3.6 - Broken Access Control Vulnerability |
| CVE-2025-58193 | WordPress Uncanny Automator Plugin <= 6.7.0.1 - Broken Access Control Vulnerability |
| CVE-2025-58198 | WordPress Xpro Theme Builder Plugin <= 1.2.9 - Broken Access Control Vulnerability |
| CVE-2025-58201 | WordPress AfterShip Tracking Plugin <= 1.17.17 - Broken Access Control Vulnerability |
| CVE-2025-58207 | WordPress Ai Image Alt Text Generator for WP Plugin <= 1.1.5 - Broken Access Control Vulnerability |
| CVE-2025-58210 | WordPress Makeaholic Theme <= 1.8.5 - Broken Access Control Vulnerability |
| CVE-2025-58221 | WordPress PilotPress Plugin <= 2.0.36 - Broken Access Control Vulnerability |
| CVE-2025-58222 | WordPress Team Manager plugin <= 2.5.1 - Broken Access Control vulnerability |
| CVE-2025-58243 | WordPress imEvent Theme <= 3.4.0 - Broken Access Control Vulnerability |
| CVE-2025-58247 | WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability |
| CVE-2025-58251 | WordPress Sticky Header Effects for Elementor Plugin <= 2.1.2 - Broken Access Control Vulnerability |
| CVE-2025-58258 | WordPress Lazy Blocks Plugin <= 4.1.0 - Broken Access Control Vulnerability |
| CVE-2025-59576 | WordPress MasterStudy LMS Plugin <= 3.6.20 - Broken Access Control Vulnerability |
| CVE-2025-59581 | WordPress Ibtana Plugin <= 1.2.5.3 - Arbitrary Content Deletion Vulnerability |
| CVE-2025-59591 | WordPress wpDiscuz Plugin <= 7.6.33 - Broken Access Control Vulnerability |
| CVE-2025-59826 | FlagForgeCTF Vulnerable to Unauthorized Problem Creation |
| CVE-2025-59827 | FlagForgeCTF is Missing Authorization in main-v2 |
| CVE-2025-59828 | Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions |
| CVE-2025-60247 | WordPress Bux Woocommerce plugin <= 1.2.3 - Broken Access Control vulnerability |
| CVE-2025-6043 | Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 17.0 - Authenticated (Subscriber+) Arbitrary File Delet... |
| CVE-2025-6105 | jflyfox jfinal_cms HOME.java cross-site request forgery |
| CVE-2025-6106 | WuKongOpenSource WukongCRM AdminRoleController.java cross-site request forgery |
| CVE-2025-6171 | Missing Authorization in GitLab |
| CVE-2025-6187 | bSecure 1.3.7 - 1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint |
| CVE-2025-6190 | Realty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profil... |
| CVE-2025-62006 | WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability |
| CVE-2025-62013 | WordPress UiChemy plugin <= 4.0.0 - Broken Access Control vulnerability |
| CVE-2025-62017 | WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability |
| CVE-2025-62018 | WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability |
| CVE-2025-62019 | WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.8 - Broken Access Control vulnerability |
| CVE-2025-62021 | WordPress Acknowledgify plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2025-62022 | WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability |
| CVE-2025-62027 | WordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerability |
| CVE-2025-62028 | WordPress Salient theme < 17.4.0 - Broken Access Control vulnerability |
| CVE-2025-62033 | WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability |
| CVE-2025-62037 | WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability |
| CVE-2025-62046 | WordPress TheGem Demo Import (for WPBakery) plugin <= 5.10.5 - Arbitrary Content Deletion vulnerability |
| CVE-2025-62048 | WordPress SmartCrawl plugin <= 3.14.3 - Broken Access Control vulnerability |
| CVE-2025-62049 | WordPress Cost Calculator Builder plugin <= 3.5.32 - Broken Access Control vulnerability |
| CVE-2025-6205 | Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 |
| CVE-2025-62052 | WordPress One Page Express Companion plugin <= 1.6.43 - Broken Access Control vulnerability |
| CVE-2025-62070 | WordPress WowRevenue plugin <= 1.2.13 - Broken Access Control vulnerability |
| CVE-2025-62071 | WordPress Social proof testimonials and reviews by Repuso plugin <= 5.29 - Broken Access Control vulnerability |
| CVE-2025-62072 | WordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerability |
| CVE-2025-62073 | WordPress MeetingHub plugin <= 1.23.9 - Broken Access Control vulnerability |
| CVE-2025-62078 | WordPress Easy Upload Files During Checkout plugin <= 3.0.0 - Broken Access Control vulnerability |
| CVE-2025-62079 | WordPress WP Export Categories & Taxonomies plugin <= 1.0.3 - Broken Access Control vulnerability |
| CVE-2025-62081 | WordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2025-62085 | WordPress BERTHA AI plugin <= 1.13 - Broken Access Control vulnerability |
| CVE-2025-62086 | WordPress Яндекс Доставка (Boxberry) plugin <= 2.34 - Broken Access Control vulnerability |
| CVE-2025-62087 | WordPress Sticky Notes for WP Dashboard plugin <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2025-62090 | WordPress Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons plugin <= 3.0.2 - Broken Access Control vulne... |
| CVE-2025-62091 | WordPress Serial Codes Generator and Validator with WooCommerce Support plugin <= 2.8.2 - Broken Access Control vulnerability |
| CVE-2025-62092 | WordPress Wiremo plugin <= 1.4.99 - Broken Access Control vulnerability |
| CVE-2025-62098 | WordPress Portfolio Gallery plugin <= 1.4.8 - Broken Access Control vulnerability |
| CVE-2025-62099 | WordPress Signature Add-On for Gravity Forms plugin <= 1.8.6 - Broken Access Control vulnerability |
| CVE-2025-62100 | WordPress ThemeRain Core plugin <= 1.1.9 - Broken Access Control vulnerability |
| CVE-2025-62104 | WordPress ACF Galerie 4 plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2025-62106 | WordPress WP-CRM System plugin <= 3.4.5 - Broken Access Control vulnerability |
| CVE-2025-62108 | WordPress Add Custom Codes plugin <= 4.80 - Broken Access Control vulnerability |
| CVE-2025-62115 | WordPress Hide Plugins plugin <= 1.0.4 - Broken Access Control vulnerability |
| CVE-2025-62116 | WordPress AI Copilot plugin <= 1.5.2 - Broken Access Control vulnerability |
| CVE-2025-62122 | WordPress Trash Duplicate and 301 Redirect plugin <= 1.9.1 - Broken Access Control vulnerability |
| CVE-2025-62128 | WordPress SiteLock Security plugin <= 5.0.1 - Broken Access Control vulnerability |
| CVE-2025-62129 | WordPress RestroPress plugin <= 3.2.7 - Broken Access Control vulnerability |
| CVE-2025-62130 | WordPress Accordion Slider Gallery plugin <= 2.7 - Broken Access Control vulnerability |
| CVE-2025-62131 | WordPress Tasty Recipes Lite plugin <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2025-62132 | WordPress Tasty Recipes Lite plugin <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2025-62138 | WordPress WP Advanced PDF plugin <= 1.1.7 - Other vulnerability Type vulnerability |
| CVE-2025-62141 | WordPress Wawp plugin <= 4.4 - Broken Access Control vulnerability |
| CVE-2025-62144 | WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.28 - Broken Access Control vulnerability |
| CVE-2025-62145 | WordPress DMCA Protection Badge plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2025-62147 | WordPress Realbig plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2025-6215 | Omnishop <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint |
| CVE-2025-62150 | WordPress History Timeline plugin <= 1.0.6 - Broken Access Control vulnerability |
| CVE-2025-62151 | WordPress Virtuaria PagBank / PagSeguro para Woocommerce plugin <= 3.6.3 - Broken Access Control vulnerability |
| CVE-2025-62152 | WordPress ConveyThis plugin <= 269.2 - Broken Access Control vulnerability |
| CVE-2025-62153 | WordPress Quick Interest Slider plugin <= 3.1.7 - Broken Access Control vulnerability |
| CVE-2025-62154 | WordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One plugin <= 1.1.7 - Broken Access... |
| CVE-2025-6253 | UiCore Elements <= 1.3.0 - Missing Authorization to Unauthenticated Arbitrary File Read |
| CVE-2025-62614 | BookLore Media API Authentication Bypass |
| CVE-2025-62642 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup AP... |
| CVE-2025-62712 | JumpServer Connection Token Leak Vulnerability |
| CVE-2025-62714 | Karmada Dashboard API Unauthorized Access Vulnerability |
| CVE-2025-62736 | WordPress Image Cleanup plugin <= 1.9.2 - Broken Access Control vulnerability |
| CVE-2025-62738 | WordPress Formstack Online Forms plugin <= 2.0.2 - Broken Access Control vulnerability |
| CVE-2025-62740 | WordPress WP-CRM System plugin <= 3.4.6 - Broken Access Control vulnerability |
| CVE-2025-62747 | WordPress Featured Image Generator plugin <= 1.3.4 - Broken Access Control vulnerability |
| CVE-2025-62751 | WordPress Vireo theme <= 1.0.24 - Broken Access Control vulnerability |
| CVE-2025-62754 | WordPress Payment Gateway bKash for WC plugin <= 3.1.0 - Broken Access Control vulnerability |
| CVE-2025-62755 | WordPress GS Portfolio for Envato plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2025-6284 | PHPGurukul Car Rental Portal cross-site request forgery |
| CVE-2025-62865 | WordPress Post Cloner plugin <= 1.0.0 - Broken Access Control vulnerability |
| CVE-2025-62867 | WordPress Ergonet Cache plugin <= 1.0.13 - Broken Access Control vulnerability |
| CVE-2025-62869 | WordPress Gravitec.net – Web Push Notifications plugin <= 2.9.17 - Broken Access Control vulnerability |
| CVE-2025-62870 | WordPress Eupago Gateway For Woocommerce plugin <= 4.7.1 - Broken Access Control vulnerability |
| CVE-2025-62874 | WordPress AnyComment plugin <= 0.3.6 - Broken Access Control vulnerability |
| CVE-2025-62881 | WordPress WP-Lister Lite for eBay plugin <= 3.8.3 - Broken Access Control vulnerability |
| CVE-2025-62882 | WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability |
| CVE-2025-62883 | WordPress Premmerce User Roles plugin <= 1.0.13 - Broken Access Control vulnerability |
| CVE-2025-62884 | WordPress Coupon Affiliates plugin <= 7.2.0 - Broken Access Control vulnerability |
| CVE-2025-62888 | WordPress WP Attachments plugin <= 5.2 - Broken Access Control vulnerability |
| CVE-2025-62889 | WordPress King Addons for Elementor plugin <= 51.1.61 - Broken Access Control vulnerability |
| CVE-2025-62892 | WordPress Sunshine Photo Cart plugin <= 3.5.3 - Broken Access Control vulnerability |
| CVE-2025-62906 | WordPress Referral Link Tracker plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2025-62908 | Без описания... |
| CVE-2025-62909 | WordPress Smart WeTransfer plugin <= 1.3 - Broken Access Control vulnerability |
| CVE-2025-62914 | WordPress Effect Maker plugin <= 1.2.1 - Broken Access Control vulnerability |
| CVE-2025-62915 | WordPress SMS Contact Form 7 Notifications by ClickSend plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2025-62916 | WordPress Flights & Hotels Booking WP Plugin plugin <= 3.1 - Broken Access Control vulnerability |
| CVE-2025-62918 | WordPress IgnitionDeck plugin <= 2.0.15 - Broken Access Control vulnerability |
| CVE-2025-62919 | WordPress TS Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerability |
| CVE-2025-62922 | WordPress Export Categories plugin <= 1.0 - Broken Access Control vulnerability |
| CVE-2025-62924 | WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability |
| CVE-2025-62925 | WordPress Conversios.io plugin <= 7.2.13 - Broken Access Control vulnerability |
| CVE-2025-62927 | WordPress Nelio Content plugin <= 4.0.5 - Broken Access Control vulnerability |
| CVE-2025-62928 | WordPress SEO Meta Description Updater plugin <= 1.2.0 - Broken Access Control vulnerability |
| CVE-2025-62929 | WordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerability |
| CVE-2025-62931 | WordPress MSN Partner Hub plugin <= 2.9 - Broken Access Control vulnerability |
| CVE-2025-62932 | WordPress Table Block by RioVizual plugin <= 3.0.0 - Broken Access Control vulnerability |
| CVE-2025-62935 | WordPress Open Close WooCommerce Store plugin <= 5.0.0 - Broken Access Control vulnerability |
| CVE-2025-62938 | WordPress Reoon Email Verifier plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2025-62944 | WordPress MSTW CSV EXPORTER plugin <= 1.4 - Broken Access Control vulnerability |
| CVE-2025-62946 | WordPress Everest Backup plugin <= 2.3.8 - Broken Access Control vulnerability |
| CVE-2025-62952 | WordPress ChatBot plugin <= 7.7.3 - Broken Access Control vulnerability |
| CVE-2025-62953 | WordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerability |
| CVE-2025-62954 | WordPress Revive Old Posts plugin <= 9.3.3 - Broken Access Control vulnerability |
| CVE-2025-62960 | WordPress Construction Light theme <= 1.6.7 - Broken Access Control vulnerability |
| CVE-2025-62961 | WordPress Sparkle FSE theme <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2025-62964 | WordPress MDTF plugin <= 1.3.6 - Broken Access Control vulnerability |
| CVE-2025-62965 | WordPress Admin Management Xtended plugin <= 2.5.1 - Broken Access Control vulnerability |
| CVE-2025-62966 | WordPress GoCache plugin <= 1.3.6 - Broken Access Control vulnerability |
| CVE-2025-62970 | WordPress Link Whisper Free plugin <= 0.9.2 - Broken Access Control vulnerability |
| CVE-2025-62972 | WordPress WebinarPress plugin <= 1.33.28 - Broken Access Control vulnerability |
| CVE-2025-62973 | WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability |
| CVE-2025-62976 | WordPress Sendle Shipping plugin <= 6.02 - Broken Access Control vulnerability |
| CVE-2025-62977 | WordPress 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin <= 2.1.4 - Broken Access Control vulnerability |
| CVE-2025-62978 | WordPress KiotViet Sync plugin <= 1.8.5 - Broken Access Control vulnerability |
| CVE-2025-62980 | WordPress Persian Admnin Fonts plugin <= 4.1.03 - Broken Access Control vulnerability |
| CVE-2025-62993 | WordPress Notification for Telegram plugin <= 3.5.1 - Broken Access Control vulnerability |
| CVE-2025-62995 | WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.12 - Broken Access Control vulnerability |
| CVE-2025-62996 | WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.12 - Broken Access Control vulnerability |
| CVE-2025-62999 | WordPress Litho Addons plugin <= 3.5 - Broken Access Control vulnerability |
| CVE-2025-63001 | WordPress Hotel Booking plugin <= 3.8 - Broken Access Control vulnerability |
| CVE-2025-63002 | WordPress Sermon Manager plugin <= 2.30.0 - Broken Access Control vulnerability |
| CVE-2025-63004 | WordPress All in One Accessibility plugin <= 1.15 - Broken Access Control vulnerability |
| CVE-2025-63006 | WordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerability |
| CVE-2025-63008 | WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability |
| CVE-2025-63015 | WordPress WooCommerce Payment Gateway – Paysera plugin <= 3.10.0 - Broken Access Control vulnerability |
| CVE-2025-63016 | WordPress QuadLayers TikTok Feed plugin <= 4.6.5 - Broken Access Control vulnerability |
| CVE-2025-63018 | WordPress Bard theme <= 2.229 - Broken Access Control vulnerability |
| CVE-2025-63022 | WordPress Simple Like Page plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2025-63023 | WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.0.53 - Broken Access Control vulnerability |
| CVE-2025-52824 | WordPress Mobile DJ Manager plugin <= 1.7.8.3 - Privilege Escalation vulnerability |
| CVE-2025-5288 | REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthent... |
| CVE-2025-55038 | AutomationDirect CLICK PLUS Missing Authorization |
| CVE-2025-55712 | WordPress The Plus Addons for Elementor Page Builder Lite Plugin <= 6.3.13 - Broken Access Control Vulnerability |
| CVE-2025-55716 | WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability |
| CVE-2025-55734 | flaskBlo Authorization Bypass |
| CVE-2025-55741 | unopim/unopim allows unauthorized product deletion via mass-delete endpoint |
| CVE-2025-5766 | code-projects Laundry System cross-site request forgery |
| CVE-2025-57817 | Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation |
| CVE-2025-57958 | Без описания... |
| CVE-2025-57961 | WordPress CoDesigner plugin <= 4.29 - Broken Access Control vulnerability |
| CVE-2025-57969 | WordPress Hide WP Toolbar Plugin <= 2.7 - Broken Access Control Vulnerability |
| CVE-2025-57971 | WordPress SALESmanago Plugin <= 3.8.1 - Broken Access Control Vulnerability |
| CVE-2025-57972 | WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerability |
| CVE-2025-57975 | WordPress Team Plugin <= 5.0.6 - Broken Access Control Vulnerability |
| CVE-2025-57976 | WordPress CardCom Payment Gateway plugin <= 3.5.0.7 - Broken Access Control vulnerability |
| CVE-2025-57985 | WordPress Ultimate Watermark Plugin <= 1.1 - Broken Access Control Vulnerability |
| CVE-2025-57987 | WordPress WP Events Manager Plugin <= 2.2.1 - Broken Access Control Vulnerability |
| CVE-2025-57990 | WordPress Blog Designer Plugin <= 3.1.8 - Broken Access Control Vulnerability |
| CVE-2025-57991 | WordPress Clariti Plugin <= 1.2.1 - Broken Access Control Vulnerability |
| CVE-2025-57995 | WordPress DethemeKit For Elementor Plugin <= 2.1.10 - Broken Access Control Vulnerability |
| CVE-2025-57997 | WordPress Trustpilot Reviews Plugin <= 2.5.925 - Broken Access Control Vulnerability |
| CVE-2025-58000 | WordPress Memberful plugin <= 1.75.0 - Broken Access Control vulnerability |
| CVE-2025-58003 | WordPress Javo Core Plugin <= 3.0.0.266 - Broken Access Control Vulnerability |
| CVE-2025-58004 | WordPress DriCub Theme <= 2.9 - Broken Access Control Vulnerability |
| CVE-2025-58009 | WordPress CP Multi View Event Calendar plugin <= 1.4.35 - Broken Access Control vulnerability |
| CVE-2025-58016 | WordPress CF7 Submissions Plugin <= 0.26 - Broken Access Control Vulnerability |
| CVE-2025-58029 | WordPress Classic Widgets with Block-based Widgets Plugin <= 1.0.1 - Broken Access Control Vulnerability |
| CVE-2025-5803 | WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Broken Access Control vulnerability |
| CVE-2025-5805 | WordPress Electron theme <= 1.8.2 - Broken Access Control vulnerability |
| CVE-2025-58073 | Arbitrary Mattermost Team can be joined by manipulating the OAuth state |
| CVE-2025-58075 | Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState |
| CVE-2025-5811 | Listly: Listicles For WordPress <= 2.7 - Unauthenticated Arbitrary Transient Deletion |
| CVE-2025-5812 | VG WORT METIS <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update |
| CVE-2025-5813 | Amazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation |
| CVE-2025-5835 | Droip <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many Actions |
| CVE-2025-5846 | Missing Authorization in GitLab |
| CVE-2025-58594 | WordPress Brizy Plugin <= 2.7.12 - Broken Access Control Vulnerability |
| CVE-2025-58599 | WordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control Vulnerability |
| CVE-2025-58600 | WordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control Vulnerability |
| CVE-2025-58601 | WordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control Vulnerability |
| CVE-2025-58603 | WordPress Surfer Plugin <= 1.6.4.574 - Broken Access Control Vulnerability |
| CVE-2025-58606 | WordPress SaasLauncher Theme <= 1.3.0 - Broken Access Control Vulnerability |
| CVE-2025-58613 | WordPress Posts Table with Search & Sort Plugin <= 1.4.10 - Broken Access Control Vulnerability |
| CVE-2025-58616 | WordPress Frisbii Pay Plugin <= 1.8.2.1 - Broken Access Control Vulnerability |
| CVE-2025-58617 | WordPress F4 Media Taxonomies Plugin <= 1.1.4 - Broken Access Control Vulnerability |
| CVE-2025-58622 | WordPress Mobile Contact Line Plugin <= 2.4.0 - Broken Access Control Vulnerability |
| CVE-2025-58629 | WordPress Miraculous theme < 2.0.9 - Arbitrary Content Deletion vulnerability |
| CVE-2025-58634 | WordPress PeachPay Payments Plugin <= 1.117.4 - Broken Access Control Vulnerability |
| CVE-2025-58635 | WordPress Support Genix Plugin <= 1.4.23 - Broken Access Control Vulnerability |
| CVE-2025-58639 | WordPress Contact Form By Mega Forms Plugin <= 1.6.1 - Broken Access Control Vulnerability |
| CVE-2025-58650 | WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Broken Access Control Vulnerability |
| CVE-2025-58660 | WordPress Oshine Core Plugin <= 1.5.5 - Broken Access Control Vulnerability |
| CVE-2025-58663 | WordPress Qubely Plugin <= 1.8.14 - Broken Access Control Vulnerability |
| CVE-2025-58664 | WordPress Text To Speech TTS Accessibility plugin <= 1.9.30 - Broken Access Control vulnerability |
| CVE-2025-58666 | WordPress Website Chat Button: Kommo integration Plugin <= 1.3.1 - Broken Access Control Vulnerability |
| CVE-2025-58667 | WordPress ListingPro Reviews plugin < 2.9.11 - Broken Access Control vulnerability |
| CVE-2025-58668 | WordPress WPLMS theme <= 4.970 - Broken Access Control vulnerability |
| CVE-2025-58672 | WordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control Vulnerability |
| CVE-2025-58678 | WordPress Accordion Plugin <= 2.3.15 - Broken Access Control Vulnerability |
| CVE-2025-58679 | WordPress AppMySite plugin <= 3.15.0 - Broken Access Control vulnerability |
| CVE-2025-58680 | WordPress Gutentor plugin <= 3.5.2 - Broken Access Control vulnerability |
| CVE-2025-58681 | WordPress Easy Quotes Plugin <= 1.2.4 - Broken Access Control Vulnerability |
| CVE-2025-58685 | WordPress Cecabank WooCommerce plugin plugin <= 0.3.4 - Broken Access Control vulnerability |
| CVE-2025-58711 | WordPress Blog Designer PRO plugin <= 3.4.8 - Broken Access Control vulnerability |
| CVE-2025-58753 | copyparty: Sharing a single file does not fully restrict access to other files in source folder |
| CVE-2025-58783 | WordPress Gutentor plugin <= 3.5.5 - Broken Access Control vulnerability |
| CVE-2025-58785 | WordPress Ray Enterprise Translation plugin <= 1.7.2 - Broken Access Control vulnerability |
| CVE-2025-58795 | WordPress Payoneer Checkout Plugin <= 3.4.0 - Content Spoofing Vulnerability |
| CVE-2025-58813 | WordPress Consultstreet Theme <= 3.0.0 - Broken Access Control Vulnerability |
| CVE-2025-58816 | WordPress Product Carousel Slider for Elementor Plugin <= 2.1.3 - Broken Access Control Vulnerability |
| CVE-2025-58817 | WordPress SoftMe Theme <= 1.1.27 - Broken Access Control Vulnerability |
| CVE-2025-58824 | WordPress Shk Corporate Theme <= 2.4.1.1 - Broken Access Control Vulnerability |
| CVE-2025-5894 | Honding Technology Smart Parking Management System - Missing Authorization |
| CVE-2025-58957 | WordPress VPSUForm Plugin <= 3.2.20 - Broken Access Control Vulnerability |
| CVE-2025-58968 | WordPress MaxiBlocks Plugin <= 2.1.3 - Broken Access Control Vulnerability |
| CVE-2025-58969 | WordPress Custom Login URL Plugin <= 1.0.2 - Broken Access Control Vulnerability |
| CVE-2025-58976 | WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability |
| CVE-2025-58978 | WordPress PDF Generator for WordPress Plugin <= 1.5.4 - Broken Access Control Vulnerability |
| CVE-2025-58979 | WordPress BerqWP Plugin <= 2.2.53 - Broken Access Control Vulnerability |
| CVE-2025-58980 | WordPress Export WP Page to Static HTML/CSS Plugin <= 4.1.0 - Broken Access Control Vulnerability |
| CVE-2025-58981 | WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability |
| CVE-2025-58986 | WordPress Jock On Air Now (JOAN) plugin <= 6.0.4 - Broken Access Control vulnerability |
| CVE-2025-5900 | Tenda AC9 cross-site request forgery |
| CVE-2025-59001 | WordPress Salient Core plugin <= 3.0.8 - Broken Access Control vulnerability |
| CVE-2025-59005 | WordPress Categorify plugin <= 1.0.7.5 - Broken Access Control vulnerability |
| CVE-2025-59011 | WordPress Traveler Theme < 3.2.3 - Arbitrary Content Deletion Vulnerability |
| CVE-2025-59017 | Broken Access Control in Backend AJAX Routes |
| CVE-2025-59021 | TYPO3 CMS Allows Broken Access Control in Redirects Module |
| CVE-2025-59022 | TYPO3 CMS Allows Broken Access Control in Recycler Module |
| CVE-2025-5919 | Appointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking... |
| CVE-2025-59353 | Manager generates mTLS certificates for arbitrary IP addresses |
| CVE-2025-59413 | CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter |
| CVE-2025-59416 | The Scratch Channel forks can publish articles |
| CVE-2025-59461 | API does not require authentication |
| CVE-2025-5953 | WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_... |
| CVE-2025-59544 | Chamilo: Unauthorized access to update category of any user |
| CVE-2025-59551 | WordPress Revive.so Plugin <= 2.0.6 - Broken Access Control Vulnerability |
| CVE-2025-59559 | WordPress Payrexx Payment Gateway for WooCommerce Plugin <= 3.1.5 - Broken Access Control Vulnerability |
| CVE-2025-5956 | WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via... |
| CVE-2025-59561 | WordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerability |
| CVE-2025-59567 | WordPress Coupon Affiliates Plugin <= 6.8.0 - Broken Access Control Vulnerability |
| CVE-2025-5957 | Guest Support – Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Tic... |
| CVE-2025-60045 | WordPress IDonatePro plugin <= 2.1.11 - Broken Access Control vulnerability |
| CVE-2025-60077 | WordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerability |
| CVE-2025-60079 | WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability |
| CVE-2025-60086 | WordPress WP Voting Contest plugin <= 5.8 - Broken Access Control vulnerability |
| CVE-2025-60088 | WordPress WebinarIgnition plugin <= 4.06.04 - Broken Access Control vulnerability |
| CVE-2025-60094 | WordPress Stackable Plugin <= 3.18.1 - Broken Access Control Vulnerability |
| CVE-2025-60096 | WordPress TheGem (Elementor) Theme <= 5.10.5 - Broken Access Control Vulnerability |
| CVE-2025-60097 | WordPress TheGem Theme <= 5.10.5 - Broken Access Control Vulnerability |
| CVE-2025-60098 | WordPress Theme My Login Plugin <= 7.1.12 - Broken Access Control Vulnerability |
| CVE-2025-60103 | WordPress ListingPro plugin <= 2.9.8 - Broken Access Control vulnerability |
| CVE-2025-60106 | WordPress EmailKit Plugin <= 1.6.0 - Arbitrary Content Deletion Vulnerability |
| CVE-2025-60116 | WordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Broken Access Control vulnerability |
| CVE-2025-60120 | WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2025-60121 | WordPress WooEvents plugin <= 4.1.7 - Broken Access Control vulnerability |
| CVE-2025-60122 | WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2025-60123 | WordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2025-60127 | WordPress CopySafe Web Protection plugin <= 5.1 - Broken Access Control vulnerability |
| CVE-2025-60128 | WordPress Delisho Plugin <= 1.1.3 - Broken Access Control Vulnerability |
| CVE-2025-60129 | WordPress Yext Plugin <= 1.1.3 - Broken Access Control Vulnerability |
| CVE-2025-60130 | WordPress WEDOS Global Plugin <= 1.2.2 - Broken Access Control Vulnerability |
| CVE-2025-60143 | WordPress Netgsm plugin <= 2.9.69 - Broken Access Control vulnerability |
| CVE-2025-60148 | WordPress Subscribe to Download plugin <= 2.0.9 - Broken Access Control vulnerability |
| CVE-2025-60152 | WordPress Subscribe To Unlock Plugin <= 1.1.5 - Broken Access Control Vulnerability |
| CVE-2025-60155 | WordPress WP Virtual Assistant Plugin <= 3.0 - Broken Access Control Vulnerability |
| CVE-2025-60159 | WordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Broken Access Control vulnerability |
| CVE-2025-60165 | WordPress Frames Theme <= 1.5.7 - Broken Access Control Vulnerability |
| CVE-2025-60166 | WordPress WP Subscription Forms PRO Plugin <= 2.0.5 - Arbitrary Content Deletion Vulnerability |
| CVE-2025-62247 | Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2... |
| CVE-2025-62256 | Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA thro... |
| CVE-2025-62293 | Broken Access Control in SOPlanning |
| CVE-2025-64520 | GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API |
| CVE-2025-6476 | SourceCodester Gym Management System cross-site request forgery |
| CVE-2025-6478 | CodeAstro Expense Management System cross-site request forgery |
| CVE-2025-65020 | Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR) |
| CVE-2025-65021 | Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR) |
| CVE-2025-65028 | Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes |
| CVE-2025-65029 | Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants |
| CVE-2025-65036 | XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro |
| CVE-2025-65089 | XWiki view file macro: User can view content of office file without view rights on the attachment |
| CVE-2025-65098 | Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass |
| CVE-2025-65112 | PubNet Critical Authentication Bypass Allows Unauthenticated Package Upload and Identity Spoofing |
| CVE-2025-66402 | misskey.js's export data contains private post data |
| CVE-2025-66525 | WordPress Elastic Email Sender plugin <= 1.2.20 - Broken Access Control vulnerability |
| CVE-2025-66526 | WordPress Tablesome plugin <= 1.1.34 - Broken Access Control vulnerability |
| CVE-2025-66527 | WordPress Lobo theme <= 2.8.6 - Broken Access Control vulnerability |
| CVE-2025-66528 | WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerability |
| CVE-2025-66530 | WordPress Webba Booking plugin <= 6.2.1 - Broken Access Control vulnerability |
| CVE-2025-66532 | WordPress Powerlift theme < 3.2.1 - Broken Access Control vulnerability |
| CVE-2025-66534 | WordPress The Aisle theme <= 2.9 - Broken Access Control vulnerability |
| CVE-2025-6664 | CodeAstro Patient Record Management System cross-site request forgery |
| CVE-2025-6685 | ATEN eco DC Missing Authorization Privilege Escalation Vulnerability |
| CVE-2025-6718 | B1.lt for WooCommerce <= 2.2.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection |
| CVE-2025-6720 | Vchasno Kasa <= 1.0.3 - Unauthenticated Log File Clearing |
| CVE-2025-6721 | Vchasno Kasa <= 1.0.3 - Missing Authorization to Unauthenticated Invoice Generation |
| CVE-2025-6726 | Block Editor Gallery Slider <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta Update |
| CVE-2025-6730 | Bonanza – WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Success |
| CVE-2025-67466 | WordPress Trinity Audio plugin <= 5.23.3 - Broken Access Control vulnerability |
| CVE-2025-67468 | WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.6 - Broken... |
| CVE-2025-67474 | WordPress ForumWP plugin <= 2.1.4 - Broken Access Control vulnerability |
| CVE-2025-6754 | SEO Metrics <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation |
| CVE-2025-67540 | WordPress Animation Addons for Elementor plugin <= 2.4.5 - Arbitrary Content Deletion vulnerability |
| CVE-2025-67547 | WordPress Konte theme <= 2.4.6 - Broken Access Control vulnerability |
| CVE-2025-67548 | WordPress WP Delicious plugin <= 1.9.1 - Broken Access Control vulnerability |
| CVE-2025-67559 | WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Broken Access Control vulnerability |
| CVE-2025-67560 | WordPress Listdom plugin <= 5.0.1 - Broken Access Control vulnerability |
| CVE-2025-67561 | WordPress Debug Log Viewer plugin <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2025-67562 | WordPress Image Caption Hover Pro plugin < 20.0 - Broken Access Control vulnerability |
| CVE-2025-67563 | WordPress Post SMTP plugin <= 3.6.1 - Broken Access Control vulnerability |
| CVE-2025-67566 | WordPress Woffice Core plugin <= 5.4.30 - Broken Access Control vulnerability |
| CVE-2025-67568 | WordPress Basel theme <= 5.9.1 - Broken Access Control vulnerability |
| CVE-2025-67569 | WordPress AdForest theme <= 6.0.11 - Broken Access Control vulnerability |
| CVE-2025-67570 | WordPress WPForms Google Sheet Connector plugin <= 4.0.0 - Broken Access Control vulnerability |
| CVE-2025-67571 | WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability |
| CVE-2025-67572 | WordPress PenNews theme < 6.7.4 - Broken Access Control vulnerability |
| CVE-2025-67573 | WordPress Sailing theme < 4.4.6 - Broken Access Control vulnerability |
| CVE-2025-67574 | WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability |
| CVE-2025-67575 | WordPress Sitewide Notice WP plugin <= 2.4.1 - Broken Access Control vulnerability |
| CVE-2025-67576 | WordPress Simple Link Directory plugin <= 8.8.3 - Broken Access Control vulnerability |
| CVE-2025-67577 | WordPress Easy Form Builder plugin <= 3.8.20 - Broken Access Control vulnerability |
| CVE-2025-67578 | WordPress WP Email Capture plugin <= 3.12.4 - Broken Access Control vulnerability |
| CVE-2025-67579 | WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability |
| CVE-2025-67580 | WordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability |
| CVE-2025-67581 | WordPress TrueBooker plugin <= 1.1.0 - Broken Access Control vulnerability |
| CVE-2025-67582 | WordPress Wbcom Designs plugin <= 2.1.1 - Broken Access Control vulnerability |
| CVE-2025-67583 | WordPress IDonate plugin <= 2.1.15 - Broken Access Control vulnerability |
| CVE-2025-63024 | WordPress Order Delivery Date for WooCommerce plugin <= 4.3.1 - Broken Access Control vulnerability |
| CVE-2025-63025 | WordPress Xagio SEO plugin <= 7.1.0.37 - Broken Access Control vulnerability |
| CVE-2025-63028 | WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability |
| CVE-2025-63031 | WordPress EasyTest plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-63034 | WordPress Page View Count plugin <= 2.9.0 - Settings Change vulnerability |
| CVE-2025-63038 | WordPress WP Custom Admin Interface plugin <= 7.40 - Broken Access Control vulnerability |
| CVE-2025-63039 | WordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerability |
| CVE-2025-63041 | WordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerability |
| CVE-2025-63047 | WordPress ListingPro theme <= 2.9.9 - Broken Access Control vulnerability |
| CVE-2025-63049 | WordPress ListingPro Lead Form plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2025-63054 | WordPress Quiz And Survey Master plugin <= 10.3.2 - Broken Access Control vulnerability |
| CVE-2025-63056 | WordPress Contact Form by BestWebSoft plugin <= 4.3.6 - Broken Access Control vulnerability |
| CVE-2025-63063 | WordPress Yandex.Metrica plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2025-63067 | WordPress Porto Theme - Functionality plugin < 3.7.3 - Broken Access Control vulnerability |
| CVE-2025-63069 | WordPress Ivory Search plugin <= 5.5.12 - Broken Access Control vulnerability |
| CVE-2025-63077 | WordPress Happy Addons for Elementor plugin <= 3.20.3 - Broken Access Control vulnerability |
| CVE-2025-63078 | WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability |
| CVE-2025-63079 | WordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2025-6341 | code-projects School Fees Payment System cross-site request forgery |
| CVE-2025-6380 | ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function |
| CVE-2025-64171 | MARIN3R: Cross-Namespace Vulnerability in the Operator |
| CVE-2025-64179 | lakeFS: Unauthenticated access to API usage metrics |
| CVE-2025-64192 | WordPress XStore theme < 9.6 - Broken Access Control vulnerability |
| CVE-2025-64199 | WordPress wpresidence theme <= 5.3.2 - Broken Access Control vulnerability |
| CVE-2025-64209 | WordPress Masterstudy theme < 4.8.122 - Broken Access Control vulnerability |
| CVE-2025-64210 | WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2025-64211 | WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2025-64212 | WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability |
| CVE-2025-64214 | WordPress MasterStudy LMS Pro plugin < 4.7.16 - Arbitrary Content Deletion vulnerability |
| CVE-2025-64215 | WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability |
| CVE-2025-64219 | WordPress Business Directory plugin <= 6.4.18 - Broken Access Control vulnerability |
| CVE-2025-64222 | WordPress WooCommerce Recover Abandoned Cart plugin <= 24.6.0 - Arbitrary Content Deletion vulnerability |
| CVE-2025-64229 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerability |
| CVE-2025-64234 | WordPress Evergreen Content Poster plugin <= 1.4.5 - Broken Access Control vulnerability |
| CVE-2025-64238 | WordPress WPS Bidouille plugin <= 1.33.1 - Broken Access Control vulnerability |
| CVE-2025-64241 | WordPress WP Coupons and Deals plugin <= 3.2.4 - Broken Access Control vulnerability |
| CVE-2025-64242 | WordPress Easy Property Listings plugin <= 3.5.22 - Broken Access Control vulnerability |
| CVE-2025-64243 | WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability |
| CVE-2025-64244 | WordPress Restrict Elementor Widgets, Columns and Sections plugin <= 1.12 - Broken Access Control vulnerability |
| CVE-2025-64245 | WordPress Import external attachments plugin <= 1.5.12 - Broken Access Control vulnerability |
| CVE-2025-64246 | WordPress Accessibility by AudioEye plugin <= 1.0.49 - Broken Access Control vulnerability |
| CVE-2025-64247 | WordPress Read More & Accordion plugin <= 3.5.5.1 - Broken Access Control vulnerability |
| CVE-2025-64248 | WordPress Request a Quote plugin <= 2.5.3 - Broken Access Control vulnerability |
| CVE-2025-64249 | WordPress Protect WP Admin plugin <= 4.1 - Broken Access Control vulnerability |
| CVE-2025-64251 | WordPress Ultimate Learning Pro plugin <= 3.9.3 - Arbitrary Content Deletion vulnerability |
| CVE-2025-64254 | WordPress Photo Block plugin <= 1.5.1 - Broken Access Control vulnerability |
| CVE-2025-64255 | WordPress Admin and Site Enhancements (ASE) plugin <= 8.0.8 - Broken Access Control vulnerability |
| CVE-2025-64257 | WordPress My Tickets plugin <= 2.1.0 - Broken Access Control vulnerability |
| CVE-2025-64259 | WordPress Theater for WordPress plugin <= 0.18.8 - Broken Access Control vulnerability |
| CVE-2025-64261 | WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability |
| CVE-2025-64263 | WordPress WP Content Pilot plugin <= 2.1.7 - Broken Access Control vulnerability |
| CVE-2025-64265 | WordPress Frontend File Manager plugin <= 23.2 - Broken Access Control vulnerability |
| CVE-2025-64268 | WordPress Timetics plugin <= 1.0.44 - Broken Access Control vulnerability |
| CVE-2025-64269 | WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.150 - Broken Access Control vulnerability |
| CVE-2025-64273 | WordPress Email marketing for WordPress by GetResponse Official plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2025-64274 | WordPress WPKoi Templates for Elementor plugin <= 3.4.4 - Broken Access Control vulnerability |
| CVE-2025-64276 | WordPress Survey Maker plugin <= 5.1.9.4 - Broken Access Control vulnerability |
| CVE-2025-64277 | WordPress ChatBot plugin <= 7.3.9 - Broken Access Control vulnerability |
| CVE-2025-64285 | WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Broken Access Control vulnerability |
| CVE-2025-64294 | WordPress WP Snow Effect plugin <= 1.1.19 - Broken Access Control vulnerability |
| CVE-2025-64296 | WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability |
| CVE-2025-68045 | WordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerability |
| CVE-2025-68048 | WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability |
| CVE-2025-68049 | WordPress bunny.net plugin <= 2.3.6 - Broken Access Control vulnerability |
| CVE-2025-68050 | WordPress Leadpages plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2025-68057 | WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2025-68058 | WordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerability |
| CVE-2025-68059 | WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2025-68069 | WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability |
| CVE-2025-68072 | WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability |
| CVE-2025-68073 | WordPress GDPR CCPA Compliance Support plugin <= 2.7.4 - Broken Access Control vulnerability |
| CVE-2025-68084 | WordPress Ultimate Auction plugin <= 4.3.3 - Broken Access Control vulnerability |
| CVE-2025-68085 | WordPress Buttoner for Elementor plugin <= 1.0.6 - Settings Change vulnerability |
| CVE-2025-68086 | WordPress Reformer for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability |
| CVE-2025-68087 | WordPress Modalier for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability |
| CVE-2025-68088 | WordPress Huger for Elementor plugin <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2025-6813 | aapanel WP Toolkit 1.0 - 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via auto_login() Fun... |
| CVE-2025-6814 | Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function |
| CVE-2025-68270 | CourseLimitedStaff Role Allows Studio Access |
| CVE-2025-68479 | Discourse subscriptions are susceptible to takeover |
| CVE-2025-68498 | WordPress JetTabs plugin <= 2.2.12 - Broken Access Control vulnerability |
| CVE-2025-68503 | WordPress JetBlog plugin <= 2.4.7 - Broken Access Control vulnerability |
| CVE-2025-68505 | WordPress H5P plugin <= 1.16.1 - Broken Access Control vulnerability |
| CVE-2025-68507 | WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability |
| CVE-2025-68508 | WordPress Brave plugin <= 0.8.3 - Broken Access Control vulnerability |
| CVE-2025-68511 | WordPress Gutenverse Form plugin <= 2.3.1 - Broken Access Control vulnerability |
| CVE-2025-68517 | WordPress Tablesome plugin <= 1.1.35.1 - Broken Access Control vulnerability |
| CVE-2025-68521 | WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability |
| CVE-2025-68522 | WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability |
| CVE-2025-68523 | WordPress Spiffy Calendar plugin <= 5.0.7 - Broken Access Control vulnerability |
| CVE-2025-68534 | WordPress PDF for WPForms plugin <= 6.3.0 - Broken Access Control vulnerability |
| CVE-2025-68535 | WordPress Sunshine Photo Cart plugin <= 3.5.7.1 - Broken Access Control vulnerability |
| CVE-2025-68542 | WordPress Checkout Gateway for IRIS plugin <= 1.3 - Broken Access Control vulnerability |
| CVE-2025-68547 | WordPress Follow My Blog Post plugin <= 2.4.0 - Arbitrary Content Deletion vulnerability |
| CVE-2025-68556 | WordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2025-68557 | WordPress Chakra test plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-68558 | WordPress Depicter Slider plugin <= 4.0.4 - Broken Access Control vulnerability |
| CVE-2025-68564 | WordPress Sendy plugin <= 3.4.2 - Broken Access Control vulnerability |
| CVE-2025-68565 | WordPress Twitch Player plugin <= 2.1.3 - Broken Access Control vulnerability |
| CVE-2025-68568 | WordPress Claspo – Popups, Spin the Wheel & Email Capture plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2025-68569 | WordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerability |
| CVE-2025-68571 | WordPress SALESmanago plugin <= 3.9.0 - Broken Access Control vulnerability |
| CVE-2025-68572 | WordPress BBP Core plugin <= 1.4.1 - Broken Access Control vulnerability |
| CVE-2025-68575 | WordPress Wappointment plugin <= 2.7.6 - Broken Access Control vulnerability |
| CVE-2025-68577 | WordPress Virusdie plugin <= 1.1.6 - Broken Access Control vulnerability |
| CVE-2025-68578 | WordPress Addonify plugin <= 2.0.4 - Broken Access Control vulnerability |
| CVE-2025-68579 | WordPress FV Simpler SEO plugin <= 1.9.6 - Broken Access Control vulnerability |
| CVE-2025-68581 | WordPress YITH Slider for page builders plugin <= 1.0.11 - Broken Access Control vulnerability |
| CVE-2025-68582 | WordPress Funnelforms Free plugin <= 3.8 - Broken Access Control vulnerability |
| CVE-2025-68585 | WordPress WP Document Revisions plugin <= 3.7.2 - Broken Access Control vulnerability |
| CVE-2025-68586 | WordPress Cooked plugin <= 1.11.3 - Broken Access Control vulnerability |
| CVE-2025-68587 | WordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerability |
| CVE-2025-68588 | WordPress TS Poll plugin <= 2.5.5 - Broken Access Control vulnerability |
| CVE-2025-68589 | WordPress WP Telegram Widget and Join Link plugin <= 2.2.12 - Broken Access Control vulnerability |
| CVE-2025-68591 | WordPress Simple File List plugin <= 6.1.18 - Broken Access Control vulnerability |
| CVE-2025-68592 | WordPress WP Adminify plugin <= 4.0.6.1 - Broken Access Control vulnerability |
| CVE-2025-68593 | WordPress WP Adminify plugin <= 4.0.6.1 - Broken Access Control vulnerability |
| CVE-2025-68594 | WordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin <= 19.12.0 - Broken Access Control vulnerability |
| CVE-2025-68595 | WordPress Widgets for Social Photo Feed plugin <= 1.8 - Broken Access Control vulnerability |
| CVE-2025-68596 | WordPress Bit Assist plugin <= 1.5.11 - Broken Access Control vulnerability |
| CVE-2025-68603 | WordPress Editorial Calendar plugin <= 3.8.8 - Broken Access Control vulnerability |
| CVE-2025-68608 | WordPress Userpro plugin <= 5.1.9 - Broken Access Control vulnerability |
| CVE-2025-68911 | WordPress Solace theme <= 2.1.16 - Broken Access Control vulnerability |
| CVE-2025-68920 | C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files... |
| CVE-2025-68947 | NSecsoft NSecKrnl process termination privilege escalation |
| CVE-2025-68976 | WordPress Eagle Booking plugin <= 1.3.4.3 - Settings Change vulnerability |
| CVE-2025-68980 | WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2025-68981 | WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-68982 | WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability |
| CVE-2025-68993 | WordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerability |
| CVE-2025-68994 | WordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability |
| CVE-2025-68995 | WordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerability |
| CVE-2025-69009 | WordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2025-69010 | WordPress Themebeez Toolkit plugin <= 1.3.5 - Broken Access Control vulnerability |
| CVE-2025-69012 | WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability |
| CVE-2025-69013 | WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability |
| CVE-2025-69015 | WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability |
| CVE-2025-69016 | WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.15 - Broken Access Control vulnerability |
| CVE-2025-69022 | WordPress HR Management Lite plugin <= 3.6 - Broken Access Control vulnerability |
| CVE-2025-69023 | WordPress Discussion Board plugin <= 2.5.7 - Broken Access Control vulnerability |
| CVE-2025-69024 | WordPress BizPrint plugin <= 4.6.7 - Broken Access Control vulnerability |
| CVE-2025-69027 | WordPress Product Delivery Date for WooCommerce – Lite plugin <= 3.2.0 - Broken Access Control vulnerability |
| CVE-2025-69028 | WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability |
| CVE-2025-69031 | WordPress Arcane theme <= 3.6.6 - Broken Access Control vulnerability |
| CVE-2025-64323 | kgateway is missing xDS authorization |
| CVE-2025-64348 | ELOG configuration file authorization bypass |
| CVE-2025-64349 | ELOG user profile missing authorization |
| CVE-2025-64350 | WordPress Rank Math SEO plugin <= 1.0.252.1 - Broken Access Control vulnerability |
| CVE-2025-64352 | WordPress Essential Addons for Elementor plugin <= 6.2.4 - Broken Access Control vulnerability |
| CVE-2025-64356 | WordPress Insert PHP Code Snippet plugin <= 1.4.3 - Broken Access Control vulnerability |
| CVE-2025-64358 | WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability |
| CVE-2025-64369 | WordPress Contact Form Email plugin <= 1.3.58 - Broken Access Control vulnerability |
| CVE-2025-64370 | WordPress YOP Poll plugin <= 6.5.38 - Broken Access Control vulnerability |
| CVE-2025-64375 | WordPress WP Social Ninja plugin <= 3.20.1 - Broken Access Control vulnerability |
| CVE-2025-64378 | WordPress ListingPro theme < 2.9.10 - Broken Access Control vulnerability |
| CVE-2025-64379 | WordPress Booster for WooCommerce plugin <= 7.4.0 - Broken Access Control vulnerability |
| CVE-2025-64382 | WordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerability |
| CVE-2025-64384 | WordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerability |
| CVE-2025-64401 | Apache OpenOffice: Remote documents loaded without prompt via IFrame |
| CVE-2025-64402 | Apache OpenOffice: Remote documents loaded without prompt via OLE objects |
| CVE-2025-64403 | Apache OpenOffice: Remote documents loaded without prompt via "external data sources" in Calc |
| CVE-2025-64404 | Apache OpenOffice: Remote documents loaded without prompt via background and bullet images |
| CVE-2025-64405 | Apache OpenOffice: Remote documents loaded without prompt via DDE function |
| CVE-2025-64407 | Apache OpenOffice: URL fetching can be used to exfiltrate arbitrary INI file values and environment variables |
| CVE-2025-6441 | Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 4.03.32 - Una... |
| CVE-2025-64630 | WordPress Business Directory plugin <= 6.4.19 - Broken Access Control vulnerability |
| CVE-2025-64631 | WordPress WCFM Marketplace plugin <= 3.7.1 - Broken Access Control vulnerability |
| CVE-2025-64632 | WordPress Google XML Sitemaps plugin <= 4.1.22 - Broken Access Control vulnerability |
| CVE-2025-64634 | WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability |
| CVE-2025-64635 | WordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerability |
| CVE-2025-64636 | WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability |
| CVE-2025-64638 | WordPress OnPay.io for WooCommerce plugin <= 1.0.47 - Broken Access Control vulnerability |
| CVE-2025-64639 | WordPress WP Compress for MainWP plugin <= 6.50.17 - Broken Access Control vulnerability |
| CVE-2025-64729 | AVEVA Process Optimization Missing Authorization |
| CVE-2025-66054 | WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability |
| CVE-2025-66058 | WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability |
| CVE-2025-66060 | WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability |
| CVE-2025-66063 | WordPress WP Google Review Slider plugin <= 17.4 - Broken Access Control vulnerability |
| CVE-2025-66065 | WordPress Gutenverse plugin <= 3.2.1 - Broken Access Control vulnerability |
| CVE-2025-66068 | WordPress InstaWP Connect plugin <= 0.1.1.9 - Broken Access Control vulnerability |
| CVE-2025-66069 | WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability |
| CVE-2025-66070 | WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability |
| CVE-2025-66071 | WordPress Custom Order Numbers for WooCommerce plugin <= 1.11.0 - Broken Access Control vulnerability |
| CVE-2025-66072 | WordPress UsersWP plugin <= 1.2.47 - Broken Access Control vulnerability |
| CVE-2025-66075 | WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability |
| CVE-2025-66076 | WordPress Woostify Sites Library plugin <= 1.6.2 - Broken Access Control vulnerability |
| CVE-2025-66077 | WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerability |
| CVE-2025-66079 | WordPress Gutenverse Form plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2025-66080 | WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability |
| CVE-2025-66082 | WordPress WpEvently plugin <= 5.0.4 - Broken Access Control vulnerability |
| CVE-2025-66083 | WordPress WpEvently plugin <= 5.0.4 - Broken Access Control vulnerability |
| CVE-2025-66084 | WordPress FluentCommunity plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2025-66085 | WordPress Arconix Shortcodes plugin <= 2.1.18 - Broken Access Control vulnerability |
| CVE-2025-66086 | WordPress SMS Alert Order Notifications plugin <= 3.8.8 - Broken Access Control vulnerability |
| CVE-2025-66087 | WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability |
| CVE-2025-66088 | WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability |
| CVE-2025-66089 | WordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerability |
| CVE-2025-66096 | WordPress Table Block by Tableberg plugin <= 0.6.9 - Broken Access Control vulnerability |
| CVE-2025-66099 | WordPress Chat Help plugin <= 3.1.3 - Broken Access Control vulnerability |
| CVE-2025-66100 | WordPress RestroPress plugin <= 3.2.3.5 - Broken Access Control vulnerability |
| CVE-2025-66101 | WordPress CBX Bookmark & Favorite plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2025-66104 | WordPress Offload, AI & Optimize with Cloudflare Images plugin <= 1.9.5 - Broken Access Control vulnerability |
| CVE-2025-66105 | WordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.8 - Broken Access Control vulnerability |
| CVE-2025-66106 | WordPress Featured Post Creative plugin <= 1.5.5 - Broken Access Control vulnerability |
| CVE-2025-66107 | WordPress Subscriptions & Memberships for PayPal plugin <= 1.1.7 - Broken Access Control vulnerability |
| CVE-2025-66108 | WordPress TNC Toolbox: Web Performance plugin <= 2.0.4 - Broken Access Control vulnerability |
| CVE-2025-66109 | WordPress Cart Weight for WooCommerce plugin <= 1.9.11 - Broken Access Control vulnerability |
| CVE-2025-66110 | WordPress Tiktok Feed plugin <= 1.0.23 - Broken Access Control vulnerability |
| CVE-2025-66112 | WordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerability |
| CVE-2025-66113 | WordPress Better Chat Support for Messenger plugin <= 1.2.18 - Broken Access Control vulnerability |
| CVE-2025-66114 | WordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerability |
| CVE-2025-66117 | WordPress Easy Form plugin <= 2.7.8 - Broken Access Control vulnerability |
| CVE-2025-66120 | WordPress CatFolders plugin <= 2.5.3 - Broken Access Control vulnerability |
| CVE-2025-66121 | WordPress SiteGround Security plugin <= 1.5.8 - Broken Access Control vulnerability |
| CVE-2025-66122 | WordPress Stylish Price List plugin <= 7.2.2 - Broken Access Control vulnerability |
| CVE-2025-66124 | WordPress Leaky Paywall plugin <= 4.22.6 - Broken Access Control vulnerability |
| CVE-2025-66127 | WordPress Essential Real Estate plugin <= 5.3.2 - Broken Access Control vulnerability |
| CVE-2025-66128 | WordPress Sendinblue for WooCommerce plugin <= 4.0.49 - Broken Access Control vulnerability |
| CVE-2025-66129 | WordPress Pochipp plugin <= 1.18.0 - Broken Access Control vulnerability |
| CVE-2025-66130 | WordPress WP Views Counter plugin <= 2.1.2 - Broken Access Control vulnerability |
| CVE-2025-66131 | WordPress Yaad Sarig Payment Gateway For WC plugin <= 2.2.11 - Broken Access Control vulnerability |
| CVE-2025-66133 | WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.7 - Broken Access Control vulnerability |
| CVE-2025-66134 | WordPress FileBird Pro plugin <= 6.5.1 - Broken Access Control vulnerability |
| CVE-2025-66135 | WordPress Imager for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability |
| CVE-2025-66136 | WordPress Carter for Elementor plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2025-66137 | WordPress Searcher for Elementor plugin <= 1.0.3 - Broken Access Control vulnerability |
| CVE-2025-66138 | WordPress Motionger for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability |
| CVE-2025-66139 | WordPress Audier For Elementor plugin <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2025-66140 | WordPress Uper for Elementor plugin <= 1.0.5 - Broken Access Control vulnerability |
| CVE-2025-66141 | WordPress Scroller plugin <= 2.0.2 - Broken Access Control vulnerability |
| CVE-2025-66142 | WordPress Comparimager for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-66143 | WordPress Crumber plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2025-66144 | WordPress Worker for Elementor plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2025-66145 | WordPress Worker for WPBakery plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2025-66146 | WordPress Logger for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2025-66147 | WordPress Coder for Elementor plugin <= 1.0.13 - Broken Access Control vulnerability |
| CVE-2025-66148 | WordPress Conformer for Elementor plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2025-66149 | WordPress UnGrabber plugin <= 3.1.3 - Broken Access Control vulnerability |
| CVE-2025-66150 | WordPress Appender plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2025-66151 | WordPress Countdowner for Elementor plugin <= 1.0.4 - Broken Access Control vulnerability |
| CVE-2025-66152 | WordPress Criptopayer for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2025-66153 | WordPress Headinger for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2025-66154 | WordPress Couponer for Elementor plugin <= 1.1.7 - Broken Access Control vulnerability |
| CVE-2025-66155 | WordPress Questionar for Elementor plugin <= 1.1.7 - Broken Access Control vulnerability |
| CVE-2025-66156 | WordPress Watcher for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2025-66157 | WordPress Sliper for Elementor plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2025-66158 | WordPress Gmaper for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2025-67584 | WordPress GoDAM plugin <= 1.4.6 - Broken Access Control vulnerability |
| CVE-2025-67586 | WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability |
| CVE-2025-67588 | WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability |
| CVE-2025-67589 | WordPress WooCommerce PDF Invoices & Packing Slips plugin <= 4.9.1 - Broken Access Control vulnerability |
| CVE-2025-67592 | WordPress My Calendar plugin <= 3.6.16 - Broken Access Control vulnerability |
| CVE-2025-67597 | WordPress Fluent Booking plugin <= 1.9.11 - Broken Access Control vulnerability |
| CVE-2025-67599 | WordPress WebToffee eCommerce Marketing Automation plugin <= 2.1.1 - Broken Access Control vulnerability |
| CVE-2025-67624 | WordPress Optimize More! – Images plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2025-67737 | AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE |
| CVE-2025-67913 | WordPress Aruba HiSpeed Cache plugin < 3.0.3 - Broken Access Control vulnerability |
| CVE-2025-67917 | WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability |
| CVE-2025-67926 | WordPress Fluent Support plugin <= 1.10.4 - Broken Access Control vulnerability |
| CVE-2025-67929 | WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability |
| CVE-2025-67939 | WordPress Tickera plugin <= 3.5.6.2 - Broken Access Control vulnerability |
| CVE-2025-67942 | WordPress Peach Payments Gateway plugin <= 3.3.6 - Broken Access Control vulnerability |
| CVE-2025-67956 | WordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerability |
| CVE-2025-67958 | WordPress TaxCloud for WooCommerce plugin <= 8.3.8 - Broken Access Control vulnerability |
| CVE-2025-67965 | WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability |
| CVE-2025-67967 | WordPress Lawyer Directory plugin <= 1.3.3 - Broken Access Control vulnerability |
| CVE-2025-67969 | WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability |
| CVE-2025-67970 | WordPress Schedula plugin <= 1.0 - Broken Access Control vulnerability |
| CVE-2025-67972 | WordPress Zoho ZeptoMail plugin <= 3.2.9 - Broken Access Control vulnerability |
| CVE-2025-67973 | WordPress Sunshine Photo Cart plugin <= 3.5.6.2 - Broken Access Control vulnerability |
| CVE-2025-67974 | WordPress WPLegalPages plugin <= 3.5.4 - Broken Access Control vulnerability |
| CVE-2025-67975 | WordPress aDirectory plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2025-67976 | WordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerability |
| CVE-2025-67977 | WordPress HAPPY plugin <= 1.0.8 - Broken Access Control vulnerability |
| CVE-2025-67993 | WordPress Atarim plugin <= 4.2.1 - Broken Access Control vulnerability |
| CVE-2025-67994 | WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerability |
| CVE-2025-68000 | WordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerability |
| CVE-2025-68003 | WordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerability |
| CVE-2025-68005 | WordPress Easy Hotel Booking plugin <= 1.9.2 - Broken Access Control vulnerability |
| CVE-2025-68007 | WordPress Event Espresso 4 Decaf plugin <= 5.0.37.decaf - Settings Change vulnerability |
| CVE-2025-68009 | WordPress Slider Templates plugin <= 1.0.3 - Broken Access Control vulnerability |
| CVE-2025-68013 | WordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerability |
| CVE-2025-68016 | WordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerability |
| CVE-2025-68018 | WordPress Order Listener for WooCommerce plugin <= 3.6.1 - Broken Access Control vulnerability |
| CVE-2025-68019 | WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability |
| CVE-2025-68020 | WordPress Notifier plugin <= 2.7.13 - Broken Access Control vulnerability |
| CVE-2025-68021 | WordPress ConveyThis plugin <= 269.9 - Broken Access Control vulnerability |
| CVE-2025-68022 | WordPress Plugin BlueX for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability |
| CVE-2025-68023 | WordPress Addonify – Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerability |
| CVE-2025-68024 | WordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability |
| CVE-2025-68025 | WordPress Addonify Floating Cart For WooCommerce plugin <= 1.2.17 - Broken Access Control vulnerability |
| CVE-2025-68026 | WordPress LC Wizard plugin <= 2.1.1 - Settings Change vulnerability |
| CVE-2025-68028 | WordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerability |
| CVE-2025-68032 | WordPress Advanced WC Analytics plugin <= 3.19.0 - Settings Change vulnerability |
| CVE-2025-68036 | WordPress CubeWP plugin <= 1.1.27 - Broken Access Control vulnerability |
| CVE-2025-68039 | WordPress WP BackItUp plugin <= 2.1.0 - Broken Access Control vulnerability |
| CVE-2025-68042 | WordPress Travelpayouts plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2025-68043 | WordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerability |
| CVE-2025-6864 | SeaCMS admin_type.php cross-site request forgery |
| CVE-2025-6865 | DaiCuo index cross-site request forgery |
| CVE-2025-68834 | WordPress Sync Master Sheet – Product Sync with Google Sheet for WooCommerce plugin <= 1.1.3 - Broken Access Control vulnerab... |
| CVE-2025-68837 | WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.5 - Broken Access Control vulnerability |
| CVE-2025-68850 | WordPress Sell Downloads plugin <= 1.1.12 - Broken Access Control vulnerability |
| CVE-2025-68861 | WordPress Plugin Optimizer plugin <= 1.3.7 - Broken Access Control vulnerability |
| CVE-2025-68882 | WordPress Scalenut plugin <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2025-68896 | WordPress WDV One Page Docs plugin <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2025-7821 | WC Plus <= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation |
| CVE-2025-7822 | WP Wallcreeper <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable |
| CVE-2025-7827 | Ni WooCommerce Customer Product Report <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
| CVE-2025-7828 | WP Filter & Combine RSS Feeds <= 0.4 - Missing Authorization to Authenticated (Contributor+) Feed Deletion |
| CVE-2025-7834 | PHPGurukul Complaint Management System cross-site request forgery |
| CVE-2025-8223 | jerryshensjf JPACookieShop 蛋糕商城JPA版 AdminTypeCustController.java cross-site request forgery |
| CVE-2025-8335 | code-projects Simple Car Rental System cross-site request forgery |
| CVE-2025-8342 | WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypass |
| CVE-2025-8357 | Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion |
| CVE-2025-8361 | Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093 |
| CVE-2025-8418 | B Slider- Gutenberg Slider Block for WP <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Ins... |
| CVE-2025-8423 | My WP Translate <= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion |
| CVE-2025-8425 | My WP Translate <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update |
| CVE-2025-69052 | WordPress Registration & Login with Mobile Phone Number for WooCommerce plugin <= 1.3.1 - Broken Access Control vulnerability |
| CVE-2025-69063 | WordPress New User Approve plugin <= 3.2.0 - Broken Access Control vulnerability |
| CVE-2025-69091 | WordPress Demo Importer Plus plugin <= 2.0.8 - Broken Access Control vulnerability |
| CVE-2025-69093 | WordPress ShopMagic plugin <= 4.7.2 - Broken Access Control vulnerability |
| CVE-2025-69095 | WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability |
| CVE-2025-69103 | WordPress Brikk theme <= 3.0.0 - Arbitrary Content Deletion vulnerability |
| CVE-2025-69134 | WordPress OpenAI Chatbot for WordPress – Helper plugin <= 1.1.4 - Arbitrary Content Deletion vulnerability |
| CVE-2025-69137 | WordPress Genemy theme <= 1.6.6 - Broken Access Control vulnerability |
| CVE-2025-69181 | WordPress Lawyer Directory plugin <= 1.3.4 - Broken Access Control vulnerability |
| CVE-2025-69184 | WordPress Institutions Directory plugin <= 1.3.4 - Broken Access Control vulnerability |
| CVE-2025-69185 | WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2025-69186 | WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2025-69187 | WordPress Final User plugin <= 1.2.5 - Broken Access Control vulnerability |
| CVE-2025-69188 | WordPress fitness-trainer plugin <= 1.7.1 - Broken Access Control vulnerability |
| CVE-2025-69189 | WordPress JobBank plugin <= 1.2.3 - Broken Access Control vulnerability |
| CVE-2025-69190 | WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability |
| CVE-2025-69191 | WordPress ListingHub plugin <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2025-69192 | WordPress Real Estate Pro plugin <= 2.1.5 - Broken Access Control vulnerability |
| CVE-2025-69193 | WordPress WP Membership plugin <= 1.6.4 - Broken Access Control vulnerability |
| CVE-2025-69220 | LibreChat has Insufficient Access Control for Agent Files |
| CVE-2025-69221 | LibreChat has Insufficient Access Control for Agent Permission Queries |
| CVE-2025-69297 | WordPress Aardvark Plugin plugin <= 2.19 - Broken Access Control vulnerability |
| CVE-2025-69298 | WordPress Gauge theme <= 6.56.4 - Broken Access Control vulnerability |
| CVE-2025-69300 | WordPress Premium Addons for Elementor plugin <= 4.11.63 - Settings Change vulnerability |
| CVE-2025-69303 | WordPress ModelTheme Framework plugin < 2.0.0 - Broken Access Control vulnerability |
| CVE-2025-69311 | WordPress Broadstreet Ads plugin <= 1.52.1 - Broken Access Control vulnerability |
| CVE-2025-69313 | WordPress PostX plugin <= 5.0.3 - Broken Access Control vulnerability |
| CVE-2025-69315 | WordPress Simply Schedule Appointments plugin <= 1.6.9.15 - Broken Access Control vulnerability |
| CVE-2025-69327 | WordPress Car Rental Manager plugin <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2025-69331 | WordPress Theater for WordPress plugin <= 0.19 - Broken Access Control vulnerability |
| CVE-2025-69332 | WordPress Bookify plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2025-69333 | WordPress JetEngine plugin <= 3.8.1.1 - Broken Access Control vulnerability |
| CVE-2025-69336 | WordPress Ultimate Store Kit Elementor Addons plugin <= 2.9.4 - Broken Access Control vulnerability |
| CVE-2025-69340 | WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability |
| CVE-2025-69341 | WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability |
| CVE-2025-69344 | WordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerability |
| CVE-2025-69345 | WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability |
| CVE-2025-69346 | WordPress AffiliateX plugin <= 1.3.9.3 - Broken Access Control vulnerability |
| CVE-2025-69348 | WordPress The Events Calendar Countdown Addon plugin <= 1.4.15 - Broken Access Control vulnerability |
| CVE-2025-69349 | WordPress RSS Feed Widget plugin <= 3.0.2 - Broken Access Control vulnerability |
| CVE-2025-69352 | WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability |
| CVE-2025-69353 | WordPress Proxy & VPN Blocker plugin <= 3.5.3 - Broken Access Control vulnerability |
| CVE-2025-69354 | WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability |
| CVE-2025-69355 | WordPress Tickera plugin <= 3.5.6.4 - Broken Access Control vulnerability |
| CVE-2025-69358 | WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability |
| CVE-2025-69359 | WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerability |
| CVE-2025-69361 | WordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerability |
| CVE-2025-69363 | WordPress Responsive Addons for Elementor plugin <= 2.0.8 - Broken Access Control vulnerability |
| CVE-2025-69364 | WordPress Breeze plugin <= 2.2.21 - Broken Access Control vulnerability |
| CVE-2025-69381 | WordPress WooCommerce Bulk Product Editor plugin <= 3.0 - Broken Access Control vulnerability |
| CVE-2025-69385 | WordPress Cartify - WooCommerce Gutenberg WordPress Theme theme <= 1.3 - Arbitrary Content Deletion vulnerability |
| CVE-2025-69388 | WordPress Cliengo – Chatbot plugin <= 3.0.4 - Broken Access Control vulnerability |
| CVE-2025-69393 | WordPress Exzo theme <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2025-6993 | Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_lo... |
| CVE-2025-7040 | Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Actio... |
| CVE-2025-7047 | Missing Authorization in Utarit Informatics' SoliClub |
| CVE-2025-7078 | 07FLYCMS/07FLY-CMS/07FlyCRM cross-site request forgery |
| CVE-2025-9484 | Missing Authorization in GitLab |
| CVE-2025-9637 | Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Informatio... |
| CVE-2025-9747 | Koillection csrf_protection_controller.js cross-site request forgery |
| CVE-2025-9954 | Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105 |
| CVE-2025-9979 | Maspik <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Export |
| CVE-2025-9984 | Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure |
| CVE-2026-0246 | Prisma Access Agent: Local Privilege Escalation Vulnerability |
| CVE-2026-0814 | Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export |
| CVE-2026-0817 | CampaignEvents API missing authorization exposes meeting and chat URLs |
| CVE-2026-0820 | RepairBuddy <= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders |
| CVE-2026-0825 | Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltrat... |
| CVE-2026-0829 | Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending |
| CVE-2026-0832 | New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclos... |
| CVE-2026-0845 | WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update |
| CVE-2026-0927 | KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary F... |
| CVE-2026-0929 | RegistrationMagic < 6.0.7.2 - Subscriber+ Form Creation |
| CVE-2026-0974 | Orderable <= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation |
| CVE-2026-0998 | Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls |
| CVE-2026-1000 | MailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data Deletion |
| CVE-2026-10029 | Event Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints |
| CVE-2026-1003 | GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Au... |
| CVE-2026-10033 | EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX... |
| CVE-2026-10034 | WP DSGVO Tools (GDPR) <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-acc... |
| CVE-2026-1004 | Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure |
| CVE-2026-1036 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment... |
| CVE-2026-1054 | RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification |
| CVE-2026-10782 | RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_... |
| CVE-2026-10787 | Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enu... |
| CVE-2026-10815 | LakshayD02 Hostel-Management-System-PHP Admin Dashboard index.php authorization |
| CVE-2026-10831 | Improper Authorization of Break Signal Commands in Devices |
| CVE-2026-10855 | MISP Event template importer authorization bypass |
| CVE-2026-1103 | AIKTP <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions |
| CVE-2026-1104 | FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Cr... |
| CVE-2026-11340 | Authorization Bypass in HAVELSAN's Open Source Project Liman MYS |
| CVE-2026-11354 | Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information E... |
| CVE-2026-11355 | DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions |
| CVE-2026-11359 | Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugi... |
| CVE-2026-11364 | Product Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Gr... |
| CVE-2026-11398 | LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer(... |
| CVE-2026-1148 | SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System cross-site request forgery |
| CVE-2026-11496 | Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Informatio... |
| CVE-2026-11801 | WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST End... |
| CVE-2026-11802 | FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action |
| CVE-2026-11807 | Eda-server: websocket missing authorization allows credential theft via activation_id spoofing |
| CVE-2026-11818 | WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API |
| CVE-2026-11821 | Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow R... |
| CVE-2026-11858 | Missing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEM |
| CVE-2026-11867 | Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization |
| CVE-2026-11868 | WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation |
| CVE-2026-11869 | WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request |
| CVE-2026-11876 | Missing Authorization in get_deployed_stack Endpoint in zenml-io/zenml |
| CVE-2026-11887 | Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass |
| CVE-2026-11907 | Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API |
| CVE-2026-11909 | Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044 |
| CVE-2026-11912 | Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Actio... |
| CVE-2026-11983 | Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax |
| CVE-2026-11984 | Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter |
| CVE-2026-11990 | KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-... |
| CVE-2026-11992 | Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation |
| CVE-2026-11995 | Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorizati... |
| CVE-2026-12000 | Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API |
| CVE-2026-12082 | Praison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclos... |
| CVE-2026-12093 | Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe... |
| CVE-2026-12094 | Advanced Contact Form 7 <= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'f... |
| CVE-2026-12097 | User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification |
| CVE-2026-12103 | Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_... |
| CVE-2026-12105 | Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via fol... |
| CVE-2026-12113 | Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosu... |
| CVE-2026-12119 | Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move... |
| CVE-2026-12122 | Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Act... |
| CVE-2026-12124 | PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter |
| CVE-2026-12133 | JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX a... |
| CVE-2026-12134 | JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_gr... |
| CVE-2026-12153 | WP Learn Manager <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearn... |
| CVE-2026-12514 | Shared Files < 1.7.70 - Unauthenticated Limited File Upload |
| CVE-2026-12515 | Katello: missing repository authorization in content_uploads exposes cross-product content existence |
| CVE-2026-1253 | Group Chat & Video Chat by AtomChat <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update |
| CVE-2026-1254 | Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary... |
| CVE-2026-12557 | Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/del... |
| CVE-2026-12593 | Privilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystem |
| CVE-2026-12631 | Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel |
| CVE-2026-12645 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to exec... |
| CVE-2026-12646 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to exec... |
| CVE-2026-12647 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to exec... |
| CVE-2026-12654 | Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modificatio... |
| CVE-2026-12689 | ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization |
| CVE-2026-12690 | ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization |
| CVE-2026-12694 | Missing Authorization in Vimesoft's Enterprise Video Platform |
| CVE-2026-12710 | Missing Authorization in Application Integration QueryEngineTask |
| CVE-2026-12715 | Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft |
| CVE-2026-12723 | Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library |
| CVE-2026-12729 | weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (... |
| CVE-2026-12738 | WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft... |
| CVE-2026-12739 | WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion |
| CVE-2026-12742 | Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 |
| CVE-2026-12758 | Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. |
| CVE-2026-1280 | Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Paramete... |
| CVE-2026-12843 | LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint |
| CVE-2026-12853 | Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getT... |
| CVE-2026-12902 | Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kaden... |
| CVE-2026-12907 | RTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation |
| CVE-2026-12955 | Cookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via... |
| CVE-2026-12956 | Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Pa... |
| CVE-2026-12973 | PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification |
| CVE-2026-1298 | Easy Replace Image <= 3.5.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacement |
| CVE-2026-12988 | WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding |
| CVE-2026-12994 | WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injectio... |
| CVE-2026-1303 | MailChimp Campaigns <= 3.2.4 - Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection |
| CVE-2026-13039 | Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API |
| CVE-2026-13078 | Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader |
| CVE-2026-1310 | Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion |
| CVE-2026-13110 | StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing A... |
| CVE-2026-1314 | 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated... |
| CVE-2026-13159 | Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation |
| CVE-2026-13167 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Au... |
| CVE-2026-13172 | Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure |
| CVE-2026-13173 | Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation |
| CVE-2026-1321 | Membership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level' |
| CVE-2026-13227 | ERPNext v16.25.0 - Improper authorization in Prospect opportunities API |
| CVE-2026-13229 | Zammad 7.0.1 - Improper authorization in ticket article attachment cloning |
| CVE-2026-13235 | AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055 |
| CVE-2026-13236 | AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056 |
| CVE-2026-13239 | WissKI - Critical - Access bypass - SA-CONTRIB-2026-059 |
| CVE-2026-13240 | Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060 |
| CVE-2026-13241 | Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061 |
| CVE-2026-13250 | Solace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJ... |
| CVE-2026-1336 | AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.5 - Missing Authorization to Unauthenticated API Key Modification |
| CVE-2026-13389 | WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST... |
| CVE-2026-13390 | The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation |
| CVE-2026-13399 | Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order |
| CVE-2026-13406 | Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure |
| CVE-2026-13414 | CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax |
| CVE-2026-13432 | ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation |
| CVE-2026-13459 | JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter |
| CVE-2026-13468 | Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{ch... |
| CVE-2026-13484 | MLflow Experiment-scoped Label Schema CRUD API authorization |
| CVE-2026-13537 | CodeAstro Human Resource Management System cross-site request forgery |
| CVE-2026-1355 | Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports |
| CVE-2026-13611 | KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure |
| CVE-2026-13692 | PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering |
| CVE-2026-13694 | Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass |
| CVE-2026-1372 | Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Act... |
| CVE-2026-13765 | LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer a... |
| CVE-2026-14168 | ads-tec Industrial IT: Vertical privilege escalation via configuration table write |
| CVE-2026-14185 | WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update |
| CVE-2026-14215 | Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger |
| CVE-2026-14245 | miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover v... |
| CVE-2026-14251 | Gitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clusterrole/role cases enables potenti... |
| CVE-2026-14259 | Board archive import bypasses team board creation permissions |
| CVE-2026-1431 | Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure |
| CVE-2026-14311 | Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to L... |
| CVE-2026-14317 | GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass |
| CVE-2026-14332 | Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action |
| CVE-2026-14341 | Missing Authorization in GitLab |
| CVE-2026-14344 | Inconsistent authorization checks in Mattermost Boards endpoints |
| CVE-2026-14349 | TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX... |
| CVE-2026-14356 | FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id}... |
| CVE-2026-14357 | DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Executi... |
| CVE-2026-14365 | TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' |
| CVE-2026-14373 | Nomad Docker driver Linux host namespace bypass |
| CVE-2026-14460 | Missing Authorization in TUBITAK BILGEM's pardus-software |
| CVE-2026-14488 | Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id'... |
| CVE-2026-14504 | Nexus Repository 3 - Authorization Bypass in Component Upload API |
| CVE-2026-14548 | Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update |
| CVE-2026-14549 | Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion |
| CVE-2026-14550 | WPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization |
| CVE-2026-14800 | imhamzaazam ecommerceFlask cross-site request forgery |
| CVE-2026-14821 | Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion |
| CVE-2026-14853 | WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization |
| CVE-2026-14862 | Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization |
| CVE-2026-14873 | Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset |
| CVE-2026-14886 | Vault Enterprise vulnerable to cross-namespace entity deletion |
| CVE-2026-14924 | Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification |
| CVE-2026-14930 | JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload |
| CVE-2026-14934 | Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise |
| CVE-2026-14941 | Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions |
| CVE-2026-1499 | WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action |
| CVE-2026-15015 | MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint |
| CVE-2026-15025 | Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure v... |
| CVE-2026-15026 | Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information E... |
| CVE-2026-15034 | flask-dashboard Flask-MonitoringDashboard cross-site request forgery |
| CVE-2026-15054 | Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission |
| CVE-2026-15060 | systemd-machined: unprivileged users can terminate arbitrary processes |
| CVE-2026-15106 | WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter |
| CVE-2026-15227 | Missing Authorization Allows Editing of Foreign Reports |
| CVE-2026-15228 | Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision |
| CVE-2026-15237 | Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint |
| CVE-2026-15246 | RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass |
| CVE-2026-15247 | Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion |
| CVE-2026-15248 | Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR |
| CVE-2026-15252 | Search Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API Access |
| CVE-2026-15291 | Chat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure |
| CVE-2026-15293 | WP Business Intelligence Lite <= 3.2.0 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitr... |
| CVE-2026-15320 | Sipeed PicoClaw pico.go rt.ReloadConfig authorization |
| CVE-2026-15332 | zhayujie CowAgent Message Endpoint channel.py authorization |
| CVE-2026-15336 | Catch Themes Demo Import <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activa... |
| CVE-2026-15345 | ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modific... |
| CVE-2026-15349 | ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber... |
| CVE-2026-15350 | The Cache Purger <= 2.3.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge'... |
| CVE-2026-15359 | Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite |
| CVE-2026-1537 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure |
| CVE-2026-15397 | Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation... |
| CVE-2026-15398 | Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing... |
| CVE-2026-15407 | Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb... |
| CVE-2026-15411 | StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing A... |
| CVE-2026-15507 | coollabsio Coolify Policy Policies authorization |
| CVE-2026-15541 | will-moss Isaiah Master Websocket server.go Server.Handle authorization |
| CVE-2026-15550 | Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admi... |
| CVE-2026-15606 | Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token |
| CVE-2026-15610 | WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync... |
| CVE-2026-15752 | zhinianboke xianyu-auto-reply Backend User Endpoint users authorization |
| CVE-2026-15783 | Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metada... |
| CVE-2026-15823 | Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via... |
| CVE-2026-15827 | GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints |
| CVE-2026-15916 | Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010 |
| CVE-2026-15930 | Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision |
| CVE-2026-15958 | Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX |
| CVE-2026-15991 | File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Quer... |
| CVE-2026-16017 | mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization |
| CVE-2026-16035 | miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send |
| CVE-2026-16038 | MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways |
| CVE-2026-16041 | MStore API < 4.21.0 - Unauthenticated Product Review Creation |
| CVE-2026-16042 | LWS Optimize < 3.4 - Subscriber+ Cache Deletion |
| CVE-2026-16047 | Board channel linking without read channel permission validation |
| CVE-2026-16049 | _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_ |
| CVE-2026-16056 | Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts |
| CVE-2026-16057 | Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library |
| CVE-2026-16081 | Sipeed PicoClaw auth.go cross-site request forgery |
| CVE-2026-16123 | nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization |
| CVE-2026-16184 | IBM WebSphere Application Server is affected by an authentication bypass |
| CVE-2026-16185 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities |
| CVE-2026-16187 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities |
| CVE-2026-16190 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities |
| CVE-2026-16197 | Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization |
| CVE-2026-16215 | geex-arts django-jet OAuth Credential Revoke authorization |
| CVE-2026-16216 | geex-arts django-jet OAuth cross-site request forgery |
| CVE-2026-16274 | Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts |
| CVE-2026-16276 | Classified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search |
| CVE-2026-16285 | WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download |
| CVE-2026-16289 | ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group |
| CVE-2026-16290 | ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group |
| CVE-2026-16300 | Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset |
| CVE-2026-1631 | Feeds for YouTube < 2.6.4 - Subscriber+ License Data Deletion |
| CVE-2026-1640 | Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation |
| CVE-2026-16454 | Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration |
| CVE-2026-16467 | Broken Access Control in Dolusoft Software's Fortilogger |
| CVE-2026-16471 | Broken Access Control in Dolusoft Software's Sonlogger |
| CVE-2026-16494 | Missing Authorization in GitLab |
| CVE-2026-1650 | MDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field Deletion |
| CVE-2026-16543 | Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision |
| CVE-2026-16544 | Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events... |
| CVE-2026-16546 | Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp |
| CVE-2026-1655 | EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Para... |
| CVE-2026-1656 | Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification |
| CVE-2026-16561 | Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure |
| CVE-2026-1657 | EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint |
| CVE-2026-16582 | Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass |
| CVE-2026-16587 | Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwr... |
| CVE-2026-16605 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization |
| CVE-2026-16608 | Download Monitor < 5.2.6 - Unauthenticated Download Log Injection |
| CVE-2026-1663 | Missing Authorization in GitLab |
| CVE-2026-16645 | PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088 |
| CVE-2026-1667 | SEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost() |
| CVE-2026-1671 | Activity Log for WordPress <= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log File |
| CVE-2026-16734 | Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation |
| CVE-2026-1674 | Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Cont... |
| CVE-2026-16750 | Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Pr... |
| CVE-2026-16774 | WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action |
| CVE-2026-16779 | Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration... |
| CVE-2026-16794 | Missing Authorization in GitLab |
| CVE-2026-16799 | Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earli... |
| CVE-2026-16930 | Power System Missing Authorization |
| CVE-2026-16938 | Power System Missing Authorization |
| CVE-2026-16962 | Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation |
| CVE-2026-16965 | Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status |
| CVE-2026-16992 | Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication |
| CVE-2026-17021 | Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering |
| CVE-2026-17070 | Vault Credential Confusion via Authorization Bypass in HAVELSAN's Liman MYS |
| CVE-2026-17087 | WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parame... |
| CVE-2026-17153 | AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-... |
| CVE-2026-17166 | Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Sett... |
| CVE-2026-1720 | WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation <= 1.4.24 - Missing Authorization to A... |
| CVE-2026-1722 | WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation |
| CVE-2026-1734 | Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization |
| CVE-2026-17350 | pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers |
| CVE-2026-1745 | SourceCodester Medical Certificate Generator App cross-site request forgery |
| CVE-2026-1748 | Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exp... |
| CVE-2026-1751 | Missing Authorization in GitLab |
| CVE-2026-17526 | Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator acco... |
| CVE-2026-17548 | Missing authorization for viewing background jobs |
| CVE-2026-17563 | WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form |
| CVE-2026-17580 | Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refre... |
| CVE-2026-17587 | My Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shi... |
| CVE-2026-17601 | Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator |
| CVE-2026-1781 | MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion |
| CVE-2026-1786 | Twitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update |
| CVE-2026-1787 | LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion |
| CVE-2026-1797 | Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files |
| CVE-2026-18030 | Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms |
| CVE-2026-18035 | User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API |
| CVE-2026-18037 | Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication |
| CVE-2026-18042 | WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation |
| CVE-2026-18058 | The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this... |
| CVE-2026-18110 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/syst... |
| CVE-2026-18115 | In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover... |
| CVE-2026-18120 | Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data |
| CVE-2026-18121 | Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/... |
| CVE-2026-18122 | Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization |
| CVE-2026-18201 | Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-org... |
| CVE-2026-18208 | Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim |
| CVE-2026-18214 | Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction |
| CVE-2026-18218 | Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero |
| CVE-2026-18233 | MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion |
| CVE-2026-18234 | MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet |
| CVE-2026-18244 | Missing Authorization in GitLab |
| CVE-2026-18276 | Missing Authorization in eScriptorium |
| CVE-2026-18277 | Missing Authorization in eScriptorium |
| CVE-2026-1830 | Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload |
| CVE-2026-1831 | YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation |
| CVE-2026-18316 | Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via actio... |
| CVE-2026-18317 | Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticate... |
| CVE-2026-1832 | ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion |
| CVE-2026-1833 | WaMate Confirm <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking |
| CVE-2026-18347 | Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Paramete... |
| CVE-2026-1835 | lcg0124 BootDo cross-site request forgery |
| CVE-2026-18421 | Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board edit... |
| CVE-2026-18422 | Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation |
| CVE-2026-18425 | IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticate... |
| CVE-2026-18426 | Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms t... |
| CVE-2026-18431 | Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write |
| CVE-2026-18436 | MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint |
| CVE-2026-18437 | MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates |
| CVE-2026-18544 | Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference |
| CVE-2026-18570 | Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed |
| CVE-2026-18571 | Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation |
| CVE-2026-18573 | Keycloak-services: keycloak-services: client access-type policy condition bypass during client update |
| CVE-2026-18594 | Advanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_c... |
| CVE-2026-1860 | Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure |
| CVE-2026-18603 | Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions |
| CVE-2026-18650 | Missing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYS |
| CVE-2026-18652 | Velociraptor STACK Type Download Path Bypasses Denied Prefix Check |
| CVE-2026-1869 | User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass |
| CVE-2026-1870 | Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure |
| CVE-2026-18704 | Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations |
| CVE-2026-18709 | Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency |
| CVE-2026-18777 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status |
| CVE-2026-18779 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booke... |
| CVE-2026-18789 | Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes |
| CVE-2026-18807 | ECS < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers |
| CVE-2026-18819 | RackTables cross-site request forgery |
| CVE-2026-18851 | Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote auth... |
| CVE-2026-1890 | LeadConnector < 3.0.22 - Unauthenticated Rest Call |
| CVE-2026-18965 | Missing Authorization in PayRange API |
| CVE-2026-1897 | WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization |
| CVE-2026-1900 | Link Whisper Free < 0.9.1 - Unauthenticated Settings and User Meta Update |
| CVE-2026-19010 | TinyAGI Message API Endpoint index.ts processMessage authorization |
| CVE-2026-19017 | Consul vulnerable to partial arbitrary file read via Vault Connect CA provider |
| CVE-2026-19043 | Authorization Bypass Critical POS Management Functions in Menulux Software's Menulux Portal |
| CVE-2026-19052 | ProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls |
| CVE-2026-1906 | PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifie... |
| CVE-2026-19081 | Missing Authorization Allows Unauthorized Access to Critical POS Functions in Gastromenum's Gastromenum Ticket and QR Menu Sy... |
| CVE-2026-1916 | WPGSI: Spreadsheet Integration <= 3.8.3 - Missing Authorization to Unauthenticated Arbitrary Post Creation and Deletion via F... |
| CVE-2026-19197 | Broken access control in dashboard snapshots |
| CVE-2026-19200 | Velociraptor Analyst overwrites live built-in artifacts through verify() |
| CVE-2026-1925 | EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Po... |
| CVE-2026-1926 | Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation |
| CVE-2026-1927 | GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Dis... |
| CVE-2026-1930 | Emailchef <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion |
| CVE-2026-1932 | Appointment Booking Calendar Plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary Appointment Status Modifica... |
| CVE-2026-1934 | Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payme... |
| CVE-2026-19345 | code-projects Task Management System UpdateTaskStatus.php authorization |
| CVE-2026-1935 | Company Posts for LinkedIn <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Delet... |
| CVE-2026-19350 | Dolibarr ERP TakePOS invoice.php fail authorization |
| CVE-2026-1937 | YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state'... |
| CVE-2026-1938 | YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/licen... |
| CVE-2026-19404 | 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenanc... |
| CVE-2026-1942 | Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Pos... |
| CVE-2026-19430 | CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all |
| CVE-2026-1944 | CallbackKiller service widget <= 1.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update |
| CVE-2026-1946 | GW AI Website Builder <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion |
| CVE-2026-1948 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deact... |
| CVE-2026-19539 | IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion |
| CVE-2026-19616 | Information Disclosure in TBC Technology's KitLogistic |
| CVE-2026-19656 | ScadaLTS Authenticated Remote Code Execution |
| CVE-2026-19728 | Extra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload |
| CVE-2026-19755 | NoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helper |
| CVE-2026-19786 | francoisjacquet RosarioSIS Modules.php cross-site request forgery |
| CVE-2026-19801 | BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link... |
| CVE-2026-19802 | Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plug... |
| CVE-2026-1981 | Winston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion |
| CVE-2026-19892 | InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure |
| CVE-2026-19946 | Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter |
| CVE-2026-19948 | Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData... |
| CVE-2026-2001 | WowRevenue <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation |
| CVE-2026-20155 | Cisco Evolved Programmable Network Manager Improper Authorization Vulnerability |
| CVE-2026-20189 | Cisco Prime Infrastructure Information Disclosure Vulnerability |
| CVE-2026-20193 | Cisco Identity Services Engine Authentication Bypass Vulnerability |
| CVE-2026-2022 | Smart Forms <= 2.6.99 - Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure |
| CVE-2026-2031 | Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution. |
| CVE-2026-20324 | Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability |
| CVE-2026-2038 | GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability |
| CVE-2026-2039 | GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability |
| CVE-2026-20483 | In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalat... |
| CVE-2026-20495 | In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escala... |
| CVE-2026-20888 | Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) |
| CVE-2026-2127 | SiteOrigin Widgets Bundle <= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution |
| CVE-2026-21429 | Emlog has Broken Access Control (BAC) |
| CVE-2026-21743 | A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions... |
| CVE-2026-21836 | HCL DominoIQ is affected by broken access control |
| CVE-2026-21865 | Discourse topic conversion permission vulnerability for moderators |
| CVE-2026-2208 | WeKan Rules rules.js RulesBleed authorization |
| CVE-2026-22172 | OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections |
| CVE-2026-22182 | wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType |
| CVE-2026-2233 | User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Author... |
| CVE-2026-22343 | WordPress WordPress Dating Theme theme <= 11.2.0 - Broken Access Control vulnerability |
| CVE-2026-22348 | WordPress Civic Cookie Control plugin <= 1.53 - Broken Access Control vulnerability |
| CVE-2026-22350 | WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.3.1 - Broken Access Control vulnerability |
| CVE-2026-22351 | WordPress WP FullCalendar plugin <= 1.6 - Broken Access Control vulnerability |
| CVE-2026-2238 | Missing Authorization in GitLab |
| CVE-2026-22445 | WordPress Apimo Connector plugin <= 2.6.5.2 - Broken Access Control vulnerability |
| CVE-2026-22447 | WordPress Prowess theme <= 1.8.1 - Broken Access Control vulnerability |
| CVE-2026-22450 | WordPress Don Peppe theme <= 1.3 - Broken Access Control vulnerability |
| CVE-2026-22458 | WordPress Wanderland theme <= 1.5 - Broken Access Control vulnerability |
| CVE-2026-22459 | WordPress WordPress CTA plugin <= 2.1.2 - Broken Access Control vulnerability |
| CVE-2026-22461 | WordPress CTX Feed plugin <= 6.6.18 - Broken Access Control vulnerability |
| CVE-2026-22466 | WordPress WP MapIt plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2026-22468 | WordPress Absolute Addons For Elementor plugin <= 1.0.14 - Broken Access Control vulnerability |
| CVE-2026-22472 | WordPress Easy Form Builder plugin <= 3.9.6 - Broken Access Control vulnerability |
| CVE-2026-22479 | WordPress Easy Post Submission plugin <= 2.4.0 - Broken Access Control vulnerability |
| CVE-2026-22481 | WordPress BD Courier Order Ratio Checker plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2026-22485 | WordPress My Album Gallery plugin <= 1.0.4 - Arbitrary File Deletion vulnerability |
| CVE-2026-22486 | WordPress Re Gallery plugin <= 1.18.9 - Broken Access Control vulnerability |
| CVE-2026-22487 | WordPress Speed Kit plugin <= 2.0.2 - Broken Access Control vulnerability |
| CVE-2026-22488 | WordPress Dashboard Welcome for Beaver Builder plugin <= 1.0.8 - Broken Access Control vulnerability |
| CVE-2026-22490 | WordPress Bulk Landing Page Creator for WordPress LPagery plugin <= 2.4.9 - Broken Access Control vulnerability |
| CVE-2026-22492 | WordPress Docket Cache plugin <= 24.07.04 - Broken Access Control vulnerability |
| CVE-2026-22517 | WordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerability |
| CVE-2026-22522 | WordPress Block Slider plugin <= 2.2.3 - Broken Access Control vulnerability |
| CVE-2026-22592 | Gogs is Vulnerable to Denial of Service |
| CVE-2026-2263 | Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion T... |
| CVE-2026-22663 | prompts.chat Authorization Bypass Information Disclosure |
| CVE-2026-22680 | OpenViking < 0.3.3 Missing Authorization via Task Polling |
| CVE-2026-22683 | Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE |
| CVE-2026-22765 | Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. A low privileged attack... |
| CVE-2026-2284 | News Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data Loss |
| CVE-2026-2299 | Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint |
| CVE-2026-2301 | Post Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMet... |
| CVE-2026-2306 | Ninja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation |
| CVE-2026-2312 | Media Library Folders <= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion an... |
| CVE-2026-23477 | Rocket.Chat Unauthorized Access to OAuth App Details |
| CVE-2026-23517 | Fleet has an Access Control vulnerability in debug/pprof endpoints |
| CVE-2026-23522 | Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion |
| CVE-2026-23537 | Feast: unauthenticated arbitrary file write |
| CVE-2026-23541 | WordPress Mail Mint plugin <= 1.19.4 - Broken Access Control vulnerability |
| CVE-2026-23543 | WordPress Essential Addons for Elementor plugin <= 6.5.5 - Broken Access Control vulnerability |
| CVE-2026-23545 | WordPress Aruba HiSpeed Cache plugin <= 3.0.4 - Broken Access Control vulnerability |
| CVE-2026-23547 | WordPress CMSMasters Content Composer plugin <= 2.5.8 - Broken Access Control vulnerability |
| CVE-2026-23548 | WordPress DirectoryPress plugin <= 3.6.25 - Broken Access Control vulnerability |
| CVE-2026-23632 | Gogs user can update repository content with read-only permission |
| CVE-2026-23681 | Missing Authorization check in a function module in SAP Support Tools Plug-In |
| CVE-2026-23683 | Missing Authorization check in SAP Fiori App (Intercompany Balance Reconciliation) |
| CVE-2026-23688 | Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services) |
| CVE-2026-2371 | Greenshift <= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load' |
| CVE-2026-23721 | OpenProject users with "View Members" permission in any project can view all Group memberships |
| CVE-2026-2373 | Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Cu... |
| CVE-2026-23799 | WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability |
| CVE-2026-23804 | WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability |
| CVE-2026-23806 | WordPress Jobs for WordPress plugin <= 2.8 - Broken Access Control vulnerability |
| CVE-2026-2381 | WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order'... |
| CVE-2026-23875 | CrawlChat's Discord Bot has a Knowledge Permission vulnerability |
| CVE-2026-23972 | WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability |
| CVE-2026-23974 | WordPress Golo theme < 1.7.5 - Broken Access Control vulnerability |
| CVE-2026-23977 | WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability |
| CVE-2026-23990 | Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims |
| CVE-2026-24004 | Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint |
| CVE-2026-24042 | Appsmith public apps can execute unpublished actions (viewMode confusion) |
| CVE-2026-24095 | Missing Permission Check on Analyze Configuration Page |
| CVE-2026-24134 | StudioCMS has an Authorization Bypass Through User-Controlled Key |
| CVE-2026-24139 | MyTube Allows Unauthorized Database Export by Guest Users |
| CVE-2026-24190 | NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause impro... |
| CVE-2026-24309 | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2026-24310 | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2026-24312 | Missing authorization check in SAP Business Workflow |
| CVE-2026-24313 | Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) |
| CVE-2026-24322 | Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) |
| CVE-2026-24326 | Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations) |
| CVE-2026-24327 | Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application) |
| CVE-2026-24353 | WordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerability |
| CVE-2026-24356 | WordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerability |
| CVE-2026-24357 | WordPress WP Recipe Maker plugin <= 10.2.4 - Broken Access Control vulnerability |
| CVE-2026-24358 | WordPress Quiz And Survey Master plugin <= 10.3.3 - Broken Access Control vulnerability |
| CVE-2026-24362 | WordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerability |
| CVE-2026-24363 | WordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerability |
| CVE-2026-24364 | WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability |
| CVE-2026-24366 | WordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerability |
| CVE-2026-24368 | WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability |
| CVE-2026-24369 | WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability |
| CVE-2026-24371 | WordPress BA Book Everything plugin <= 1.8.16 - Broken Access Control vulnerability |
| CVE-2026-24375 | WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability |
| CVE-2026-24376 | WordPress WPVulnerability plugin <= 4.2.1 - Broken Access Control vulnerability |
| CVE-2026-24380 | WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability |
| CVE-2026-24382 | WordPress News Magazine X theme <= 1.2.50 - Broken Access Control vulnerability |
| CVE-2026-24386 | WordPress Element Invader – Template Kits for Elementor plugin <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2026-24387 | WordPress WP Quick Post Duplicator plugin <= 2.1 - Broken Access Control vulnerability |
| CVE-2026-24388 | WordPress WPMasterToolKit plugin <= 2.14.0 - Broken Access Control vulnerability |
| CVE-2026-24421 | phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user |
| CVE-2026-2446 | Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update |
| CVE-2026-24520 | WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability |
| CVE-2026-24522 | WordPress WP Subscribe plugin <= 1.2.16 - Broken Access Control vulnerability |
| CVE-2026-24524 | WordPress Tablesome plugin <= 1.2.8 - Broken Access Control vulnerability |
| CVE-2026-24525 | WordPress CLP Varnish Cache plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2026-24527 | WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.14.0 - Broken Access Control vulnerability |
| CVE-2026-24529 | WordPress Quick Restaurant Reservations plugin <= 1.6.7 - Broken Access Control vulnerability |
| CVE-2026-24530 | WordPress WebP Conversion plugin <= 2.2 - Broken Access Control vulnerability |
| CVE-2026-24532 | WordPress SiteLock Security plugin <= 5.0.2 - Broken Access Control vulnerability |
| CVE-2026-24534 | WordPress Booter plugin <= 1.5.7 - Broken Access Control vulnerability |
| CVE-2026-24535 | WordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2026-24539 | WordPress Protección de datos – RGPD plugin <= 0.68 - Broken Access Control vulnerability |
| CVE-2026-24540 | WordPress Integrate Google Drive plugin <= 1.5.6 - Broken Access Control vulnerability |
| CVE-2026-24541 | WordPress Download After Email plugin <= 2.1.9 - Broken Access Control vulnerability |
| CVE-2026-24543 | WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability |
| CVE-2026-24544 | WordPress HD Quiz plugin <= 2.0.9 - Broken Access Control vulnerability |
| CVE-2026-24545 | WordPress QR Redirector plugin <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2026-24546 | WordPress GamiPress plugin <= 7.6.3 - Broken Access Control vulnerability |
| CVE-2026-24547 | WordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerability |
| CVE-2026-24551 | WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2026-24556 | WordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerability |
| CVE-2026-24560 | WordPress Cloudinary plugin <= 3.3.2 - Broken Access Control vulnerability |
| CVE-2026-24561 | WordPress FluentBoards plugin <= 1.91.1 - Broken Access Control vulnerability |
| CVE-2026-24562 | WordPress Ryviu – Product Reviews for WooCommerce plugin <= 3.1.26 - Broken Access Control vulnerability |
| CVE-2026-24563 | WordPress LifePress plugin <= 2.2.1 - Broken Access Control vulnerability |
| CVE-2026-24566 | WordPress iNET Webkit plugin <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2026-24567 | WordPress Anything Order by Terms plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2026-24568 | WordPress WP Travel plugin <= 11.1.0 - Broken Access Control vulnerability |
| CVE-2026-24569 | WordPress Media Library File Size plugin <= 1.6.7 - Broken Access Control vulnerability |
| CVE-2026-24570 | WordPress Edwiser Bridge plugin <= 4.3.2 - Broken Access Control vulnerability |
| CVE-2026-24571 | WordPress BOX NOW Delivery plugin <= 3.0.2 - Broken Access Control vulnerability |
| CVE-2026-24575 | WordPress WishList Member X plugin <= 3.29.0 - Broken Access Control vulnerability |
| CVE-2026-24577 | WordPress Pie Register plugin <= 3.8.4.8 - Broken Access Control vulnerability |
| CVE-2026-24578 | WordPress Admin login URL Change plugin <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2026-24579 | WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Broken Access Control vulnerability |
| CVE-2026-2458 | Unauthorized channel enumeration in private teams after member removal |
| CVE-2026-24580 | WordPress Ecwid Shopping Cart plugin <= 7.0.5 - Broken Access Control vulnerability |
| CVE-2026-24581 | WordPress Points and Rewards for WooCommerce plugin <= 2.9.5 - Broken Access Control vulnerability |
| CVE-2026-24582 | WordPress FlexTable plugin <= 3.24.0 - Broken Access Control vulnerability |
| CVE-2026-24583 | WordPress SumUp Payment Gateway For WooCommerce plugin <= 2.7.9 - Broken Access Control vulnerability |
| CVE-2026-24585 | WordPress Hyyan WooCommerce Polylang Integration plugin <= 1.5.0 - Broken Access Control vulnerability |
| CVE-2026-24586 | WordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability |
| CVE-2026-24587 | WordPress AJAX Hits Counter + Popular Posts Widget plugin <= 0.10.210305 - Broken Access Control vulnerability |
| CVE-2026-24588 | WordPress Smart Product Viewer plugin <= 1.5.4 - Broken Access Control vulnerability |
| CVE-2026-24590 | WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerability |
| CVE-2026-24592 | WordPress Auto Affiliate Links plugin <= 6.8.8.3 - Broken Access Control vulnerability |
| CVE-2026-24595 | WordPress Zoho CRM Lead Magnet plugin <= 1.8.1.9 - Broken Access Control vulnerability |
| CVE-2026-24598 | WordPress Multilanguage by BestWebSoft plugin <= 1.5.2 - Broken Access Control vulnerability |
| CVE-2026-24603 | WordPress Universal Google Adsense and Ads manager plugin <= 1.1.8 - Broken Access Control vulnerability |
| CVE-2026-24604 | WordPress Simple GDPR Cookie Compliance plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2026-24605 | WordPress X Addons for Elementor plugin <= 1.0.23 - Broken Access Control vulnerability |
| CVE-2026-24606 | WordPress Bayarcash WooCommerce plugin <= 4.3.13 - Broken Access Control vulnerability |
| CVE-2026-24607 | WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability |
| CVE-2026-24610 | WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability |
| CVE-2026-24611 | WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability |
| CVE-2026-24612 | WordPress Orchid Store theme <= 1.5.15 - Broken Access Control vulnerability |
| CVE-2026-24613 | WordPress Ecwid Shopping Cart plugin <= 7.0.6 - Broken Access Control vulnerability |
| CVE-2026-24615 | WordPress Cream Magazine theme <= 2.1.10 - Broken Access Control vulnerability |
| CVE-2026-24616 | WordPress WP Popups plugin <= 2.2.0.5 - Broken Access Control vulnerability |
| CVE-2026-24619 | WordPress PopCash.Net Code Integration Tool plugin <= 1.8 - Broken Access Control vulnerability |
| CVE-2026-24622 | WordPress Suggestion Toolkit plugin <= 5.0 - Broken Access Control vulnerability |
| CVE-2026-24625 | WordPress File Uploads Addon for WooCommerce plugin <= 1.7.3 - Broken Access Control vulnerability |
| CVE-2026-24627 | WordPress Trusona for WordPress plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2026-2463 | Unauthorized access to invite ID during team creation |
| CVE-2026-24633 | WordPress Add Expires Headers & Optimized Minify plugin <= 3.2.0 - Broken Access Control vulnerability |
| CVE-2026-24636 | WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability |
| CVE-2026-24638 | WordPress RepairBuddy plugin <= 4.1121 - Broken Access Control vulnerability |
| CVE-2026-24777 | OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts |
| CVE-2026-2488 | ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion |
| CVE-2026-24939 | WordPress Modula Image Gallery plugin <= 2.13.6 - Broken Access Control vulnerability |
| CVE-2026-24940 | WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerability |
| CVE-2026-24941 | WordPress WP Job Portal plugin <= 2.4.4 - Broken Access Control vulnerability |
| CVE-2026-24944 | WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerability |
| CVE-2026-24945 | WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability |
| CVE-2026-24946 | WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerability |
| CVE-2026-24947 | WordPress LA-Studio Element Kit for Elementor plugin < 1.5.6.3 - Broken Access Control vulnerability |
| CVE-2026-24951 | WordPress myCred plugin <= 2.9.7.3 - Broken Access Control vulnerability |
| CVE-2026-24957 | WordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerability |
| CVE-2026-24965 | WordPress Contest Gallery plugin <= 28.1.1 - Broken Access Control vulnerability |
| CVE-2026-24967 | WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerability |
| CVE-2026-24972 | WordPress Elated Listing plugin <= 1.4 - Broken Access Control vulnerability |
| CVE-2026-24982 | WordPress Spectra plugin <= 2.19.17 - Broken Access Control vulnerability |
| CVE-2026-24984 | WordPress Visual Link Preview plugin <= 2.2.9 - Broken Access Control vulnerability |
| CVE-2026-24985 | WordPress WP Forms Signature Contract Add-On plugin <= 1.8.2 - Broken Access Control to Notice Dismissal vulnerability |
| CVE-2026-24987 | WordPress WP System Log plugin <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2026-24990 | WordPress WP Docs plugin <= 2.2.8 - Broken Access Control vulnerability |
| CVE-2026-24994 | WordPress Sunshine Photo Cart plugin <= 3.5.7.2 - Broken Access Control vulnerability |
| CVE-2026-24995 | WordPress Latest Post Shortcode plugin <= 14.2.0 - Broken Access Control vulnerability |
| CVE-2026-24996 | WordPress WPElemento Importer plugin <= 0.6.4 - Broken Access Control vulnerability |
| CVE-2026-24997 | WordPress Wired Impact Volunteer Management plugin <= 2.8 - Broken Access Control vulnerability |
| CVE-2026-24999 | WordPress Alma plugin <= 5.16.1 - Broken Access Control vulnerability |
| CVE-2026-25000 | WordPress Wheel of Life plugin <= 1.2.0 - Broken Access Control vulnerability |
| CVE-2026-25003 | WordPress Client Portal plugin <= 1.2.1 - Broken Access Control vulnerability |
| CVE-2026-25009 | WordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerability |
| CVE-2026-25010 | WordPress Share This Image plugin <= 2.09 - Broken Access Control vulnerability |
| CVE-2026-25011 | WordPress WP Custom Admin Interface plugin <= 7.41 - Broken Access Control vulnerability |
| CVE-2026-25012 | WordPress WP Bannerize Pro plugin <= 1.11.0 - Broken Access Control vulnerability |
| CVE-2026-25016 | WordPress Nelio Popups plugin <= 1.3.5 - Broken Access Control vulnerability |
| CVE-2026-25019 | WordPress Atarim plugin <= 4.3.1 - Broken Access Control vulnerability |
| CVE-2026-25020 | WordPress WP Sync for Notion plugin <= 1.7.0 - Broken Access Control vulnerability |
| CVE-2026-25021 | WordPress Mizan Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerability |
| CVE-2026-25026 | WordPress Team plugin <= 5.0.11 - Broken Access Control vulnerability |
| CVE-2026-25028 | WordPress ElementInvader Addons for Elementor plugin <= 1.4.1 - Broken Access Control vulnerability |
| CVE-2026-25034 | WordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerability |
| CVE-2026-25036 | WordPress Passster plugin <= 4.2.25 - Broken Access Control vulnerability |
| CVE-2026-25038 | Gitea private organization labels are visible to unauthorized users |
| CVE-2026-2504 | Dealia – Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset |
| CVE-2026-25045 | Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role) |
| CVE-2026-25058 | Vexa's unauthenticated internal transcript endpoint exposed by default |
| CVE-2026-25083 | GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in... |
| CVE-2026-25124 | OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export |
| CVE-2026-25131 | OpenEMR has Broken Access Control in Procedures Configuration |
| CVE-2026-2515 | Hostinger Reach <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Integration API Key Update |
| CVE-2026-25164 | OpenEMR's Document and Insurance REST Endpoints Skip ACL |
| CVE-2026-2518 | FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation |
| CVE-2026-2520 | Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limi... |
| CVE-2026-25242 | Gogs allows unauthenticated file uploads |
| CVE-2026-25308 | WordPress Simple Membership plugin <= 4.6.9 - Broken Access Control vulnerability |
| CVE-2026-25309 | WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability |
| CVE-2026-25311 | WordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability |
| CVE-2026-25312 | WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability |
| CVE-2026-25313 | WordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerability |
| CVE-2026-25314 | WordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerability |
| CVE-2026-25315 | WordPress hCaptcha for WP plugin <= 4.21.1 - Broken Access Control vulnerability |
| CVE-2026-25317 | WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerability |
| CVE-2026-25318 | WordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerability |
| CVE-2026-25320 | WordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerability |
| CVE-2026-25321 | WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability |
| CVE-2026-25323 | WordPress OSM plugin <= 6.1.12 - Broken Access Control vulnerability |
| CVE-2026-25327 | WordPress Five Star Restaurant Reservations plugin <= 2.7.9 - Broken Access Control vulnerability |
| CVE-2026-25329 | WordPress Quiz And Survey Master plugin <= 10.3.4 - Broken Access Control vulnerability |
| CVE-2026-25330 | WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability |
| CVE-2026-25332 | WordPress Endless Posts Navigation plugin <= 2.2.9 - Broken Access Control vulnerability |
| CVE-2026-25333 | WordPress Shopwell theme <= 1.0.11 - Broken Access Control vulnerability |
| CVE-2026-25335 | WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability |
| CVE-2026-25336 | WordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2026-25338 | WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerability |
| CVE-2026-25348 | WordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerability |
| CVE-2026-25363 | WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability |
| CVE-2026-25364 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability |
| CVE-2026-25365 | WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability |
| CVE-2026-25367 | WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability |
| CVE-2026-25368 | WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability |
| CVE-2026-25370 | WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability |
| CVE-2026-25372 | WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability |
| CVE-2026-25374 | WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability |
| CVE-2026-25375 | WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability |
| CVE-2026-25384 | WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability |
| CVE-2026-25386 | WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability |
| CVE-2026-25387 | WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability |
| CVE-2026-25388 | WordPress Ads Pro plugin <= 5.0 - Broken Access Control vulnerability |
| CVE-2026-25390 | WordPress New User Approve plugin <= 3.2.3 - Broken Access Control vulnerability |
| CVE-2026-25391 | WordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerability |
| CVE-2026-25393 | WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability |
| CVE-2026-25394 | WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability |
| CVE-2026-25395 | WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2026-25396 | WordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerability |
| CVE-2026-25398 | WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability |
| CVE-2026-25399 | WordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2026-25401 | WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability |
| CVE-2026-25402 | WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 16.011.0 - Broken Access Control vulnerability |
| CVE-2026-25403 | WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability |
| CVE-2026-25404 | WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability |
| CVE-2026-25407 | WordPress Cookiebot plugin <= 4.6.4 - Broken Access Control vulnerability |
| CVE-2026-25408 | WordPress Broken Link Notifier plugin <= 1.3.5 - Broken Access Control vulnerability |
| CVE-2026-25409 | WordPress JAMstack Deployments plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2026-25410 | WordPress WP-CORS plugin <= 0.2.2 - Broken Access Control vulnerability |
| CVE-2026-25415 | WordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerability |
| CVE-2026-25416 | WordPress News Kit Elementor Addons plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2026-25419 | WordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerability |
| CVE-2026-25420 | WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability |
| CVE-2026-25423 | WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerability |
| CVE-2026-25424 | WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability |
| CVE-2026-25425 | WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability |
| CVE-2026-25426 | WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability |
| CVE-2026-25427 | WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability |
| CVE-2026-25430 | WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.2 - Broken Access Contr... |
| CVE-2026-25431 | WordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerability |
| CVE-2026-25436 | WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability |
| CVE-2026-25437 | WordPress GZSEO plugin <= 2.0.14 - Broken Access Control vulnerability |
| CVE-2026-25440 | WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability |
| CVE-2026-25441 | WordPress LeadConnector plugin <= 3.0.21 - Broken Access Control vulnerability |
| CVE-2026-25443 | WordPress Fraud Prevention For Woocommerce plugin <= 2.3.3 - Arbitrary Content Deletion vulnerability |
| CVE-2026-25444 | WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability |
| CVE-2026-25454 | WordPress The League theme <= 4.4.1 - Broken Access Control vulnerability |
| CVE-2026-25455 | WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability |
| CVE-2026-25456 | WordPress Automated FedEx live/manual rates with shipping labels plugin <= 5.1.9 - Broken Access Control vulnerability |
| CVE-2026-25459 | WordPress Sober theme <= 3.5.12 - Broken Access Control vulnerability |
| CVE-2026-25460 | WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability |
| CVE-2026-25462 | WordPress avalex plugin <= 3.1.3 - Broken Access Control vulnerability |
| CVE-2026-25466 | WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability |
| CVE-2026-25469 | WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability |
| CVE-2026-25473 | WordPress WZone plugin <= 14.0.31 - Broken Access Control vulnerability |
| CVE-2026-25517 | Wagtail has improper permission handling on admin preview endpoints |
| CVE-2026-25531 | Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects |
| CVE-2026-25538 | Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage |
| CVE-2026-2559 | Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite |
| CVE-2026-25609 | profile command may permit unauthorized configuration |
| CVE-2026-25633 | Statamic's missing authorization allows access to assets |
| CVE-2026-25714 | Gitea user organization API bypasses public-only token filtering |
| CVE-2026-25742 | Zulip: Anonymous File Access After Disabling Spectator Access |
| CVE-2026-25752 | FUXA Unauthenticated Remote Arbitrary Device Tag Write |
| CVE-2026-25768 | LavinMQ is missing vhost access control |
| CVE-2026-25806 | PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR) |
| CVE-2026-25808 | Hollo DMs get leaked and can be seen on Webfinger Browser |
| CVE-2026-25810 | PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts |
| CVE-2026-25876 | PlaciPy is Missing Authorization on Assessment Results Endpoint |
| CVE-2026-25903 | Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates |
| CVE-2026-25939 | FUXA Unauthenticated Remote Arbitrary Scheduler Write |
| CVE-2026-2601 | Missing Authorization in GitLab |
| CVE-2026-2608 | Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization |
| CVE-2026-26083 | A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSa... |
| CVE-2026-26103 | Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api |
| CVE-2026-26104 | Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api |
| CVE-2026-26207 | DIscourse's discourse-policy plugin lacks post access check |
| CVE-2026-26236 | QuMagie |
| CVE-2026-26237 | QuMagie |
| CVE-2026-26268 | Cursor sandbox escape via Git hooks |
| CVE-2026-2633 | Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Up... |
| CVE-2026-26358 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker wit... |
| CVE-2026-26367 | JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount |
| CVE-2026-26368 | JUNG eNet SMART HOME server 2.2.1/2.3.1 Account Takeover via resetUserPassword |
| CVE-2026-2651 | Missing Authorization Validation in mlflow/mlflow |
| CVE-2026-2658 | newbee-ltd newbee-mall Multiple Endpoints cross-site request forgery |
| CVE-2026-26939 | Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration |
| CVE-2026-26977 | Frappe Learning Management System exposes details of unpublished courses to unauthorized users |
| CVE-2026-26979 | Discourse: TL4 users are able to change status of restricted topics |
| CVE-2026-27021 | Discourse: Poll voters endpoint lacked post visibility checks |
| CVE-2026-27042 | WordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerability |
| CVE-2026-27046 | WordPress StoreCustomizer plugin <= 2.6.3 - Broken Access Control vulnerability |
| CVE-2026-27055 | WordPress Penci AI SmartContent Creator plugin <= 2.0 - Broken Access Control vulnerability |
| CVE-2026-27056 | WordPress iThemes Sync plugin <= 3.2.8 - Broken Access Control vulnerability |
| CVE-2026-27066 | Без описания... |
| CVE-2026-27071 | WordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerability |
| CVE-2026-27091 | WordPress UiPress lite plugin <= 3.5.09 - Broken Access Control vulnerability |
| CVE-2026-27092 | WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability |
| CVE-2026-27111 | Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints |
| CVE-2026-27150 | Discourse doesn't ensure guardian check when creating QueryGroupBookmark |
| CVE-2026-27151 | Discourse doesn't validate destination topic when moving posts |
| CVE-2026-27181 | MajorDoMo Unauthenticated Module Uninstall via Market Endpoint |
| CVE-2026-2720 | Hr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure |
| CVE-2026-2732 | Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background... |
| CVE-2026-27327 | WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability |
| CVE-2026-27328 | WordPress EduBlink theme <= 2.0.7 - Broken Access Control vulnerability |
| CVE-2026-27330 | WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability |
| CVE-2026-27331 | WordPress WpTravelly plugin <= 2.1.5 - Broken Access Control vulnerability |
| CVE-2026-27344 | WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability |
| CVE-2026-27345 | WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability |
| CVE-2026-27346 | WordPress B2BKing plugin < 5.2.10 - Broken Access Control vulnerability |
| CVE-2026-27347 | WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability |
| CVE-2026-27351 | WordPress Crew HRM plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-27355 | WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability |
| CVE-2026-27357 | WordPress WP Search Analytics plugin < 1.5.0 - Broken Access Control vulnerability |
| CVE-2026-27361 | WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Broken Access Control vulnerability |
| CVE-2026-27362 | WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Broken Access Control vulnerability |
| CVE-2026-27364 | WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability |
| CVE-2026-27366 | WordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerability |
| CVE-2026-27368 | WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Broken Access Control vulner... |
| CVE-2026-27374 | WordPress WooCommerce Order Details plugin <= 3.1 - Broken Access Control vulnerability |
| CVE-2026-27377 | WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability |
| CVE-2026-27378 | WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability |
| CVE-2026-27386 | WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerability |
| CVE-2026-27387 | WordPress DirectoryPress plugin <= 3.6.26 - Broken Access Control vulnerability |
| CVE-2026-27388 | WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability |
| CVE-2026-27391 | WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2026-27392 | WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2026-27393 | WordPress CF7 WOW Styler plugin <= 1.7.6 - Broken Access Control vulnerability |
| CVE-2026-27396 | WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability |
| CVE-2026-27398 | WordPress RSVP and Event Management plugin <= 2.7.16 - Broken Access Control vulnerability |
| CVE-2026-27399 | WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability |
| CVE-2026-27405 | WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability |
| CVE-2026-27409 | WordPress Webba Booking plugin <= 6.4.13 - Broken Access Control vulnerability |
| CVE-2026-27416 | WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability |
| CVE-2026-27418 | WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability |
| CVE-2026-27422 | WordPress YT Player plugin <= 2.0.9 - Broken Access Control vulnerability |
| CVE-2026-27423 | WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability |
| CVE-2026-27424 | WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Broken Access Control vulnerability |
| CVE-2026-27433 | WordPress Motors theme <= 5.6.80 - Broken Access Control vulnerability |
| CVE-2026-27435 | WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability |
| CVE-2026-27454 | Discourse has check revision visibility on posts endpoint |
| CVE-2026-27457 | Weblate: Missing access control for the AddonViewSet API exposes all addon configurations |
| CVE-2026-27468 | Mastodon may allow unconfirmed FASP to make subscriptions |
| CVE-2026-27471 | ERP: Document access through endpoints due to missing validation |
| CVE-2026-27484 | OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows |
| CVE-2026-27491 | Discourse has a bypass of official warnings messages by non-staff users |
| CVE-2026-27535 | WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability |
| CVE-2026-27604 | FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions |
| CVE-2026-27608 | Parse Dashboard Missing Authorization on Agent Endpoint |
| CVE-2026-27638 | ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode |
| CVE-2026-27672 | Missing Authorization check in Material Master Application |
| CVE-2026-27673 | Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise) |
| CVE-2026-27676 | Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures) |
| CVE-2026-27677 | Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment) |
| CVE-2026-27678 | Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures) |
| CVE-2026-27679 | Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures) |
| CVE-2026-27686 | Missing Authorization check in SAP Business Warehouse (Service API) |
| CVE-2026-27687 | Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal |
| CVE-2026-27688 | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2026-27708 | FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access |
| CVE-2026-27769 | Connected Workspaces: Malicious remote server can manipulate arbitrary user's status |
| CVE-2026-27771 | Gitea Composer package source links use insufficient permission checks |
| CVE-2026-27783 | Gitea issue-template APIs bypass repository unit authorization |
| CVE-2026-27792 | Seerr missing authentication on pushSubscription endpoints |
| CVE-2026-27796 | Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak) |
| CVE-2026-27833 | Piwigo: Unauthenticated Information Disclosure via pwg.history.search API |
| CVE-2026-27836 | phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint |
| CVE-2026-27946 | ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API |
| CVE-2026-27954 | LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints |
| CVE-2026-27999 | WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability |
| CVE-2026-28005 | WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability |
| CVE-2026-28038 | WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.21.1 - Broken Access Control vulnerability |
| CVE-2026-28070 | WordPress WP eMember plugin <= v10.2.2 - Broken Access Control vulnerability |
| CVE-2026-28071 | WordPress pixfort Core plugin <= 3.2.22 - Broken Access Control vulnerability |
| CVE-2026-28076 | WordPress Guff theme <= 1.0.1 - Broken Access Control vulnerability |
| CVE-2026-28080 | WordPress Rank Math SEO PRO plugin <= 3.0.95 - Broken Access Control vulnerability |
| CVE-2026-28104 | WordPress Site Suggest plugin <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2026-28140 | WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability |
| CVE-2026-28147 | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnera... |
| CVE-2026-28153 | WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken A... |
| CVE-2026-28159 | WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability |
| CVE-2026-28163 | WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability |
| CVE-2026-28173 | WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability |
| CVE-2026-28181 | WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability |
| CVE-2026-28186 | WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability |
| CVE-2026-28188 | WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-2819 | Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization |
| CVE-2026-28190 | WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability |
| CVE-2026-28217 | IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections |
| CVE-2026-28254 | Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge |
| CVE-2026-2826 | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) M... |
| CVE-2026-28276 | Initiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint |
| CVE-2026-28309 | SolarWinds Serv-U Broken Access Control Vulnerability |
| CVE-2026-28310 | SolarWinds Serv-U Privilege Escalation Vulnerability |
| CVE-2026-28408 | WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php |
| CVE-2026-28424 | Statamic's missing authorization allows access to email addresses |
| CVE-2026-28433 | Misskey lacks resource ownership validation |
| CVE-2026-28515 | openDCIM <= 23.04 Missing Authorization in install.php |
| CVE-2026-28554 | wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler |
| CVE-2026-28555 | wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler |
| CVE-2026-28556 | wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers |
| CVE-2026-28557 | wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler |
| CVE-2026-28567 | WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability |
| CVE-2026-28571 | WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability |
| CVE-2026-28790 | OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login |
| CVE-2026-2890 | Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse |
| CVE-2026-2899 | Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion |
| CVE-2026-2900 | Missing Authorization in GitLab |
| CVE-2026-29070 | Open WebUI has unauthorized deletion of knowledge files |
| CVE-2026-29072 | Discourse missing permission check for policy creation in discourse-policy |
| CVE-2026-29073 | SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access |
| CVE-2026-29180 | Fleet's team maintainer can transfer hosts from any team via missing source team authorization |
| CVE-2026-2941 | Linksy Search and Replace <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via links... |
| CVE-2026-29789 | Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification |
| CVE-2026-2992 | KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard |
| CVE-2026-30233 | OliveTin: View permission not being checked when returning dashboards |
| CVE-2026-3045 | Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settin... |
| CVE-2026-3056 | Seraphinite Accelerator <= 2.28.14 - Missing Authorization to Authenticated (Subscriber+) Log Clearing |
| CVE-2026-3072 | Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modifica... |
| CVE-2026-30784 | Без описания... |
| CVE-2026-30797 | RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server |
| CVE-2026-30823 | Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration |
| CVE-2026-30842 | Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars |
| CVE-2026-30845 | Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication |
| CVE-2026-30850 | Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization |
| CVE-2026-30885 | WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure |
| CVE-2026-30889 | Discourse has Unauthorized Post Data Exposure in discourse-user-notes |
| CVE-2026-30911 | Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization |
| CVE-2026-30920 | OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding |
| CVE-2026-30926 | SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content |
| CVE-2026-30950 | AutoGPT has Authenticated Session Hijacking via IDOR |
| CVE-2026-30956 | OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header |
| CVE-2026-30959 | OneUptime has WhatsApp Resend Verification Authorization Bypass |
| CVE-2026-30968 | Coral Server has insufficient validation of agent identity for SSE connections |
| CVE-2026-30970 | Session authentication bypass in Coral Server session creation endpoint |
| CVE-2026-3098 | Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll |
| CVE-2026-3117 | Instance and webhook GitLab plugin commands were able to be run by non-admin users |
| CVE-2026-3138 | Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE T... |
| CVE-2026-3141 | FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter |
| CVE-2026-3143 | Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation |
| CVE-2026-3155 | OneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'po... |
| CVE-2026-3174 | Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update |
| CVE-2026-3176 | Missing Authorization in GitLab |
| CVE-2026-31800 | Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes |
| CVE-2026-31821 | Sylius is Missing Authorization in API v2 Add Item Endpoint |
| CVE-2026-31834 | Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks |
| CVE-2026-31915 | WordPress Flatsome theme <= 3.19.6 - Broken Access Control vulnerability |
| CVE-2026-31916 | WordPress Latest Post Shortcode plugin <= 14.2.1 - Broken Access Control vulnerability |
| CVE-2026-31919 | WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1 - Broken Access Control vulnerability |
| CVE-2026-31921 | WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-3193 | Chia Blockchain send_transaction cross-site request forgery |
| CVE-2026-31936 | Combodo iTop: Unauthorized access to object information via search operation |
| CVE-2026-31942 | LibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keys |
| CVE-2026-3208 | Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosu... |
| CVE-2026-32122 | OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2) |
| CVE-2026-32126 | OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Pla... |
| CVE-2026-32131 | ZITADEL Cross-Tenant Information Disclosure in Management API |
| CVE-2026-32230 | Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a s... |
| CVE-2026-3225 | LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion |
| CVE-2026-3226 | LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering |
| CVE-2026-32268 | Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability |
| CVE-2026-32270 | Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonym... |
| CVE-2026-32312 | GLPI: Unauthorized export of form structure |
| CVE-2026-32329 | WordPress Advanced Related Posts plugin <= 1.9.1 - Broken Access Control vulnerability |
| CVE-2026-32331 | WordPress Textmetrics plugin <= 3.6.4 - Broken Access Control vulnerability |
| CVE-2026-32332 | WordPress Easy Form plugin <= 2.7.9 - Broken Access Control vulnerability |
| CVE-2026-32334 | WordPress JobScout theme <= 1.1.7 - Broken Access Control vulnerability |
| CVE-2026-32335 | WordPress The Conference theme <= 1.2.5 - Broken Access Control vulnerability |
| CVE-2026-32336 | WordPress Rara Business theme <= 1.3.0 - Broken Access Control vulnerability |
| CVE-2026-32337 | WordPress Preschool and Kindergarten theme <= 1.2.5 - Broken Access Control vulnerability |
| CVE-2026-32338 | WordPress Construction Landing Page theme <= 1.4.1 - Broken Access Control vulnerability |
| CVE-2026-32339 | WordPress Bakes And Cakes theme <= 1.2.9 - Broken Access Control vulnerability |
| CVE-2026-32340 | WordPress Business One Page theme <= 1.3.2 - Broken Access Control vulnerability |
| CVE-2026-32341 | WordPress Benevolent theme <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2026-32345 | WordPress Perfect Portfolio theme <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2026-32346 | WordPress Travel Agency theme <= 1.5.5 - Broken Access Control vulnerability |
| CVE-2026-32347 | WordPress Restaurant and Cafe theme <= 1.2.5 - Broken Access Control vulnerability |
| CVE-2026-32348 | WordPress MAS Videos plugin <= 1.3.2 - Broken Access Control vulnerability |
| CVE-2026-32350 | WordPress Chocolate House theme <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2026-32362 | WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2026-32363 | WordPress WPLifeCycle plugin <= 3.3.1 - Broken Access Control vulnerability |
| CVE-2026-32370 | WordPress Influencer theme <= 1.1.7 - Broken Access Control vulnerability |
| CVE-2026-32371 | WordPress Elegant Pink theme <= 1.3.3 - Broken Access Control vulnerability |
| CVE-2026-32373 | WordPress SMS Alert Order Notifications plugin <= 3.9.0 - Broken Access Control vulnerability |
| CVE-2026-32374 | WordPress The Minimal theme <= 1.2.9 - Broken Access Control vulnerability |
| CVE-2026-32375 | WordPress Travel Diaries theme <= 1.2.4 - Broken Access Control vulnerability |
| CVE-2026-32376 | WordPress Kalon theme <= 1.2.9 - Broken Access Control vulnerability |
| CVE-2026-32377 | WordPress Pranayama Yoga theme <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-32378 | WordPress Book Landing Page theme <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2026-32379 | WordPress Rara Academic theme <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-32380 | WordPress Numinous theme <= 1.3.0 - Broken Access Control vulnerability |
| CVE-2026-32381 | WordPress App Landing Page theme <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-32382 | WordPress Digital Download theme <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2026-32383 | WordPress Ridhi theme <= 1.1.2 - Broken Access Control vulnerability |
| CVE-2026-32385 | WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability |
| CVE-2026-32386 | WordPress Envo Extra plugin <= 1.9.13 - Broken Access Control vulnerability |
| CVE-2026-32387 | WordPress Checkout for PayPal plugin <= 1.0.46 - Broken Access Control vulnerability |
| CVE-2026-32388 | WordPress GLB theme <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-32389 | WordPress NanoCare theme < 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-32390 | WordPress Nanosoft theme < 1.3.2 - Broken Access Control vulnerability |
| CVE-2026-32391 | WordPress SmartFix theme < 1.2.4 - Broken Access Control vulnerability |
| CVE-2026-32394 | WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability |
| CVE-2026-32395 | WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.6 - Broken Access Control vulnerability |
| CVE-2026-32396 | WordPress Team plugin <= 5.0.13 - Broken Access Control vulnerability |
| CVE-2026-32397 | WordPress Filter & Grids plugin <= 3.5.1 - Broken Access Control vulnerability |
| CVE-2026-32402 | WordPress Image Slider by Ays plugin <= 2.7.1 - Broken Access Control vulnerability |
| CVE-2026-32404 | WordPress Studio99 WP Monitor plugin <= 1.0.3 - Broken Access Control vulnerability |
| CVE-2026-32406 | WordPress WPC Product Bundles for WooCommerce plugin <= 8.4.5 - Broken Access Control vulnerability |
| CVE-2026-32407 | WordPress WPC Smart Wishlist for WooCommerce plugin <= 5.0.8 - Broken Access Control vulnerability |
| CVE-2026-32408 | WordPress Brizy plugin <= 2.7.23 - Broken Access Control vulnerability |
| CVE-2026-32409 | WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability |
| CVE-2026-32410 | WordPress WBW Currency Switcher for WooCommerce plugin <= 2.2.5 - Broken Access Control vulnerability |
| CVE-2026-32413 | WordPress Permalink Manager Lite plugin < 2.5.3 - Broken Access Control vulnerability |
| CVE-2026-32416 | WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability |
| CVE-2026-32417 | WordPress Pochipp plugin < 1.18.9 - Broken Access Control vulnerability |
| CVE-2026-32421 | WordPress Post Timeline plugin <= 2.4.1 - Broken Access Control vulnerability |
| CVE-2026-32423 | WordPress Admin and Site Enhancements (ASE) plugin <= 8.4.0 - Broken Access Control vulnerability |
| CVE-2026-32425 | WordPress Payment Gateway Pix For GiveWP plugin <= 2.2.3 - Broken Access Control vulnerability |
| CVE-2026-32427 | WordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2026-32428 | WordPress Popup Like box plugin <= 3.7.7 - Broken Access Control vulnerability |
| CVE-2026-32432 | WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerability |
| CVE-2026-32434 | WordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability |
| CVE-2026-32435 | WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability |
| CVE-2026-32436 | WordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability |
| CVE-2026-32437 | WordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability |
| CVE-2026-32438 | WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability |
| CVE-2026-32439 | WordPress BigHearts theme <= 3.1.14 - Broken Access Control vulnerability |
| CVE-2026-32440 | WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability |
| CVE-2026-32441 | WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability |
| CVE-2026-32442 | WordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerability |
| CVE-2026-32445 | WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability |
| CVE-2026-32446 | WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability |
| CVE-2026-32447 | WordPress Atarim plugin <= 4.3.2 - Broken Access Control vulnerability |
| CVE-2026-32451 | WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability |
| CVE-2026-32452 | WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability |
| CVE-2026-32453 | WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability |
| CVE-2026-32457 | WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.18 - Broken Access Control vulnerability |
| CVE-2026-32461 | WordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability |
| CVE-2026-32472 | WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability |
| CVE-2026-32480 | WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability |
| CVE-2026-32483 | WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability |
| CVE-2026-32485 | WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability |
| CVE-2026-32486 | WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2026-32487 | WordPress Lawyer Landing Page theme <= 1.2.7 - Broken Access Control vulnerability |
| CVE-2026-32489 | WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability |
| CVE-2026-32495 | WordPress WP Terms Popup plugin <= 2.10.0 - Broken Access Control vulnerability |
| CVE-2026-32498 | WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability |
| CVE-2026-32501 | WordPress WP Configurator Pro plugin <= 3.7.9 - Broken Access Control vulnerability |
| CVE-2026-32514 | WordPress Petitioner plugin <= 0.7.3 - Broken Access Control vulnerability |
| CVE-2026-32515 | WordPress Miraculous theme < 2.1.2 - Broken Access Control vulnerability |
| CVE-2026-32527 | WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.5 - Broken Access Con... |
| CVE-2026-32541 | WordPress Premmerce Redirect Manager plugin <= 1.0.12 - Broken Access Control vulnerability |
| CVE-2026-32543 | WordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2026-32546 | WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerability |
| CVE-2026-32548 | WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability |
| CVE-2026-32549 | WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability |
| CVE-2026-32562 | WordPress PPWP plugin <= 1.9.15 - Broken Access Control vulnerability |
| CVE-2026-32565 | WordPress Contextual Related Posts plugin < 4.2.2 - Broken Access Control vulnerability |
| CVE-2026-32583 | WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability |
| CVE-2026-32586 | WordPress Booster for WooCommerce plugin < 7.11.3 - Broken Access Control vulnerability |
| CVE-2026-32587 | WordPress WP EasyPay plugin <= 4.2.11 - Broken Access Control vulnerability |
| CVE-2026-32622 | SQLBot: Remote Code Execution via Terminology Poisoning |
| CVE-2026-32648 | Anviz Products Missing Authorization |
| CVE-2026-32658 | Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker... |
| CVE-2026-3266 | Improper access control vulnerability has been discovered in OpenText™ Filr. |
| CVE-2026-32736 | Hytale Modding Wiki has Insecure Direct Object Reference / GDPR PII Exposure |
| CVE-2026-3279 | Enable jQuery Migrate Helper <= 1.4.1 - Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade |
| CVE-2026-32817 | Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion |
| CVE-2026-32818 | Admidio is Missing Authorization on Forum Topic and Post Deletion |
| CVE-2026-32905 | OpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command |
| CVE-2026-33047 | Combodo iTop: Object can be locked by a user without write permissions |
| CVE-2026-33093 | Anviz Products Missing Authorization |
| CVE-2026-33137 | XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} |
| CVE-2026-33141 | Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data |
| CVE-2026-33159 | Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users |
| CVE-2026-33160 | Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL |
| CVE-2026-33161 | Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users |
| CVE-2026-33162 | Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permis... |
| CVE-2026-33177 | Statamic is missing authorization check on taxonomy term creation via fieldtype |
| CVE-2026-33214 | Weblate has improper access control for the translation memory API |
| CVE-2026-33229 | XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API |
| CVE-2026-33290 | WPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment_approve... |
| CVE-2026-33304 | OpenEMR has Authorization Bypass in Dated Reminders Log |
| CVE-2026-33305 | OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor |
| CVE-2026-33316 | Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement |
| CVE-2026-33318 | Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers |
| CVE-2026-3335 | Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload |
| CVE-2026-33353 | Soft Serve: Authenticated repo import can clone server-local private repositories |
| CVE-2026-33357 | Meari OpenAPI device status IDOR |
| CVE-2026-33359 | Meari unauthenticated alert image access in cloud object storage |
| CVE-2026-33408 | Discourse has Improper Authorization in "Post Edits" Report For Moderators |
| CVE-2026-33413 | etcd: Authorization bypasses in multiple APIs |
| CVE-2026-33420 | Vaultwarden missing authorization check allows Manager-role users to enumerate all collections |
| CVE-2026-33423 | Discourse staff can modify any user's group notification level |
| CVE-2026-33425 | Discourse has inferable private group membership or existence via exclude_groups parameter |
| CVE-2026-33426 | Discourse users can edit or synonymize hidden tags they can't see |
| CVE-2026-33427 | Discourse Authorization Page Displays Unvalidated Redirect Domain |
| CVE-2026-33470 | Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id... |
| CVE-2026-33484 | Langflow has Unauthenticated IDOR on Image Downloads |
| CVE-2026-33495 | Ory Oathkeeper has an authentication bypass by usage of untrusted header |
| CVE-2026-33501 | AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin |
| CVE-2026-3351 | Authorization Bypass in LXD GET /1.0/certificates Endpoint |
| CVE-2026-33514 | Discourse: Information Disclosure in Form Template API Due to Missing Authorization |
| CVE-2026-3358 | Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment |
| CVE-2026-3360 | Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter |
| CVE-2026-33631 | ClearanceKit: opfilter policy bypass via non-open file operations |
| CVE-2026-33632 | ClearanceKit: opfilter policy bypass via exchangedata and clone operations |
| CVE-2026-33638 | Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint |
| CVE-2026-33684 | AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Me... |
| CVE-2026-33685 | AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data |
| CVE-2026-33708 | Chamilo LMS has REST API PII Exposure via get_user_info_from_username |
| CVE-2026-33712 | TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls |
| CVE-2026-33759 | AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents |
| CVE-2026-33761 | AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings |
| CVE-2026-33768 | Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` |
| CVE-2026-33776 | Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information |
| CVE-2026-33785 | Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenario |
| CVE-2026-33802 | Junos OS: EX Series: Unauthorized users can execute service-impacting CLI command |
| CVE-2026-33866 | Authorization Bypass in MLflow AJAX Endpoint |
| CVE-2026-33887 | Statamic allows unauthorized content access through missing authorization in its revision controllers |
| CVE-2026-33915 | OpenEMR Missing ACL Checks on Insurance Company API Routes |
| CVE-2026-33918 | OpenEMR Missing Authorization on Claim File Download Endpoint |
| CVE-2026-33934 | OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures |
| CVE-2026-33950 | signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity |
| CVE-2026-34024 | Missing authorization checks in Wertheim SafeController Software allow low-privileged users to access restricted functions |
| CVE-2026-34042 | act: actions/cache server allows malicious cache injection |
| CVE-2026-34046 | Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check |
| CVE-2026-34048 | Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on te... |
| CVE-2026-34050 | Coolify Settings/Updates Livewire component missing instance administrator authorization |
| CVE-2026-34053 | OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler |
| CVE-2026-34154 | Discourse has a subscription access bypass in its discourse-subscriptions plugin |
| CVE-2026-34184 | Missing Authorization inAlanWeb SCADA |
| CVE-2026-34233 | CtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints |
| CVE-2026-34245 | AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking |
| CVE-2026-34247 | AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False... |
| CVE-2026-34256 | Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) |
| CVE-2026-3426 | RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification |
| CVE-2026-34261 | Missing Authorization check in SAP Business Analytics and SAP Content Management |
| CVE-2026-3431 | Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion |
| CVE-2026-3432 | Sim Studio AI - Unauthenticated OAuth Token Theft |
| CVE-2026-34358 | CtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass |
| CVE-2026-34369 | AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification |
| CVE-2026-34395 | AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php |
| CVE-2026-3445 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16... |
| CVE-2026-3462 | Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification |
| CVE-2026-34722 | Zammad is missing authorization in ticket create endpoint |
| CVE-2026-34737 | AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug |
| CVE-2026-3475 | Instant Popup Builder <= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter |
| CVE-2026-34759 | OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SM... |
| CVE-2026-34766 | Electron: USB device selection not validated against filtered device list |
| CVE-2026-3477 | PZ Frontend Manager <= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' Parameter |
| CVE-2026-34782 | Zammad has improper access control in AI assistance controller for text tools |
| CVE-2026-3480 | WP Blockade <= 0.9.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'shortcode' Pa... |
| CVE-2026-34836 | Combodo iTop: Improper access control in ajax.render.php and ajax.document.php |
| CVE-2026-34837 | Zammad is miissing authorization in AI assistance controller for context data used in text tools |
| CVE-2026-3488 | WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Au... |
| CVE-2026-34886 | WordPress Simple Membership plugin <= 4.7.1 - Broken Access Control vulnerability |
| CVE-2026-34892 | WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability |
| CVE-2026-34898 | WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2026-34899 | WordPress LTL Freight Quotes – Worldwide Express Edition plugin <= 5.2.1 - Broken Access Control vulnerability |
| CVE-2026-34903 | WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability |
| CVE-2026-34976 | Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization |
| CVE-2026-35033 | Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection |
| CVE-2026-3506 | WP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeover |
| CVE-2026-35061 | Anviz Products Missing Authorization |
| CVE-2026-35063 | Missing Authorization in OpenPLC_V3 |
| CVE-2026-35175 | Ajenti has an authorization bypass during custom package installation |
| CVE-2026-35179 | WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php |
| CVE-2026-35182 | Missing Authorization Privilege Escalation |
| CVE-2026-3524 | Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check |
| CVE-2026-35438 | Windows Admin Center Elevation of Privilege Vulnerability |
| CVE-2026-35443 | NamelessMC: Forum reactions bypass the "view own topics only" restriction |
| CVE-2026-35448 | WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php |
| CVE-2026-3550 | RockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions |
| CVE-2026-3552 | SurfLink < 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Actio... |
| CVE-2026-35561 | Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver |
| CVE-2026-35598 | Vikunja has Missing Authorization on CalDAV Task Read |
| CVE-2026-35606 | File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check |
| CVE-2026-35620 | OpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commands |
| CVE-2026-35621 | OpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence |
| CVE-2026-35630 | OpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons |
| CVE-2026-35631 | OpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat Commands |
| CVE-2026-35660 | OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset |
| CVE-2026-35662 | OpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send Action |
| CVE-2026-3567 | RepairBuddy <= 4.1132 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_set... |
| CVE-2026-3569 | Liaison Site Prober <= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint |
| CVE-2026-3570 | Smarter Analytics <= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter |
| CVE-2026-3571 | Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.8 - Missing Authorization to Unauthenticated Regist... |
| CVE-2026-3581 | Basic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Update |
| CVE-2026-3582 | Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope |
| CVE-2026-3595 | Riaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' Parameter |
| CVE-2026-3596 | Riaxe Product Customizer <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation... |
| CVE-2026-3601 | User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modifica... |
| CVE-2026-3614 | AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation |
| CVE-2026-3637 | Mattermost fails to enforce create_post permission when editing posts |
| CVE-2026-3638 | Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-pri... |
| CVE-2026-3640 | STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint |
| CVE-2026-3642 | e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX |
| CVE-2026-3645 | Punnel <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action |
| CVE-2026-3646 | LTL Freight Quotes – R+L Carriers Edition <= 3.3.13 - Missing Authorization to Unauthenticated Settings Update |
| CVE-2026-3649 | Katalogportal-pdf-sync Widget <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'kat... |
| CVE-2026-3651 | Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-... |
| CVE-2026-3770 | SourceCodester Computer Laboratory Management System cross-site request forgery |
| CVE-2026-38056 | ST Engineering iDirect iQ-Series Terminals Missing Authorization |
| CVE-2026-3829 | WP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tamp... |
| CVE-2026-3831 | Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensi... |
| CVE-2026-3895 | WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Sc... |
| CVE-2026-3896 | Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting |
| CVE-2026-3897 | Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorizati... |
| CVE-2026-3906 | WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API |
| CVE-2026-39348 | OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachmen... |
| CVE-2026-39351 | Frappe allows unrestricted Doctype access via API exploit |
| CVE-2026-39355 | Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team... |
| CVE-2026-39360 | RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration |
| CVE-2026-39386 | Neko has Self-service Privilege Escalation for Authenticated Users |
| CVE-2026-39397 | @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-regi... |
| CVE-2026-39401 | Privilege Escalation via update_event Job Output in Cronicle |
| CVE-2026-39429 | kcp's cache server is accessible without authentication or authorization checks |
| CVE-2026-39432 | WordPress Timetics plugin <= 1.0.53 - Broken Access Control vulnerability |
| CVE-2026-39433 | WordPress WPAMS plugin < 49.5.3 - Arbitrary Content Deletion vulnerability |
| CVE-2026-39448 | WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability |
| CVE-2026-39476 | WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability |
| CVE-2026-39477 | WordPress CartFlows plugin <= 2.2.3 - Broken Access Control vulnerability |
| CVE-2026-39485 | WordPress Youtube Embed Plus plugin <= 14.2.4 - Broken Access Control vulnerability |
| CVE-2026-39488 | WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability |
| CVE-2026-39490 | WordPress JupiterX Core plugin <= 4.14.1 - Broken Access Control vulnerability |
| CVE-2026-39501 | WordPress FOX plugin <= 1.4.5 - Broken Access Control vulnerability |
| CVE-2026-39503 | WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability |
| CVE-2026-39504 | WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerability |
| CVE-2026-39505 | WordPress Seriously Simple Podcasting plugin <= 3.14.2 - Broken Access Control vulnerability |
| CVE-2026-39506 | WordPress AI Engine (Pro) plugin < 3.4.2 - Broken Access Control vulnerability |
| CVE-2026-39509 | WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability |
| CVE-2026-39513 | WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability |
| CVE-2026-39515 | WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability |
| CVE-2026-39520 | WordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerability |
| CVE-2026-39524 | WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability |
| CVE-2026-39525 | WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerability |
| CVE-2026-39528 | WordPress WP Delicious plugin <= 1.9.5 - Broken Access Control vulnerability |
| CVE-2026-39533 | WordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Control vulnerability |
| CVE-2026-39534 | WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability |
| CVE-2026-39535 | WordPress Display Eventbrite Events plugin <= 6.5.6 - Broken Access Control vulnerability |
| CVE-2026-39543 | WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability |
| CVE-2026-39561 | WordPress Revive.so plugin <= 2.0.7 - Broken Access Control vulnerability |
| CVE-2026-39562 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerability |
| CVE-2026-39563 | WordPress Share This Image plugin <= 2.12 - Broken Access Control vulnerability |
| CVE-2026-39565 | WordPress WpTravelly plugin <= 2.1.7 - Broken Access Control vulnerability |
| CVE-2026-39569 | WordPress 12 Step Meeting List plugin <= 3.19.9 - Broken Access Control vulnerability |
| CVE-2026-39584 | WordPress RepairBuddy plugin <= 4.1132 - Broken Access Control vulnerability |
| CVE-2026-39585 | WordPress Booktics plugin <= 1.0.16 - Broken Access Control vulnerability |
| CVE-2026-39588 | WordPress NM Gift Registry and Wishlist Lite plugin <= 5.13 - Broken Access Control vulnerability |
| CVE-2026-39592 | WordPress DEPART plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2026-39593 | WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2026-39594 | WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability |
| CVE-2026-39595 | WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability |
| CVE-2026-39602 | WordPress Order Tracking plugin <= 3.4.3 - Broken Access Control vulnerability |
| CVE-2026-39605 | WordPress Super Custom Login plugin <= 1.1 - Broken Access Control vulnerability |
| CVE-2026-39606 | WordPress BizReview plugin <= 1.5.13 - Broken Access Control vulnerability |
| CVE-2026-39607 | WordPress Filter Plus plugin <= 1.1.17 - Broken Access Control vulnerability |
| CVE-2026-39608 | WordPress iPOSpays Gateways WC plugin <= 1.3.7 - Broken Access Control vulnerability |
| CVE-2026-39609 | WordPress Wava Payment plugin <= 0.3.7 - Broken Access Control vulnerability |
| CVE-2026-39610 | WordPress WpXmas-Snow plugin <= 1.1 - Broken Access Control vulnerability |
| CVE-2026-39612 | WordPress KuteShop theme <= 4.2.9 - Arbitrary Shortcode Execution vulnerability |
| CVE-2026-39614 | WordPress JW Player for WordPress plugin <= 2.3.6 - Broken Access Control vulnerability |
| CVE-2026-39622 | WordPress Education Base theme <= 3.0.8 - Broken Access Control vulnerability |
| CVE-2026-39624 | WordPress Biolife theme <= 3.2.3 - Arbitrary Shortcode Execution vulnerability |
| CVE-2026-39627 | WordPress Ashe theme <= 2.266 - Broken Access Control vulnerability |
| CVE-2026-39631 | WordPress WPSchoolPress plugin <= 2.2.35 - Broken Access Control vulnerability |
| CVE-2026-39637 | WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerability |
| CVE-2026-39639 | WordPress RPS Include Content plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-39643 | WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerability |
| CVE-2026-39644 | WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability |
| CVE-2026-39648 | WordPress Cream Blog theme <= 2.1.7 - Broken Access Control vulnerability |
| CVE-2026-39649 | WordPress Royale News theme <= 2.2.4 - Broken Access Control vulnerability |
| CVE-2026-39650 | WordPress UnitechPay plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2026-39651 | WordPress Total Poll Lite plugin <= 4.12.0 - Broken Access Control vulnerability |
| CVE-2026-39652 | WordPress iGMS Direct Booking plugin <= 1.3 - Broken Access Control vulnerability |
| CVE-2026-39653 | WordPress Video Conferencing with Zoom plugin <= 4.6.6 - Broken Access Control vulnerability |
| CVE-2026-39655 | WordPress Mayosis Core plugin <= 5.4.7 - Broken Access Control vulnerability |
| CVE-2026-39656 | WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability |
| CVE-2026-39657 | WordPress leadlovers forms plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2026-39658 | WordPress Panda Pods Repeater Field plugin <= 1.5.12 - Broken Access Control vulnerability |
| CVE-2026-39659 | Без описания... |
| CVE-2026-39660 | Без описания... |
| CVE-2026-39662 | WordPress Product Price by Formula for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability |
| CVE-2026-39663 | WordPress TrueBooker plugin <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2026-39664 | WordPress Leadrebel plugin <= 1.0.2 - Broken Access Control vulnerability |
| CVE-2026-39668 | WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability |
| CVE-2026-39669 | WordPress NitroPack plugin <= 1.19.3 - Broken Access Control vulnerability |
| CVE-2026-39672 | WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2026-39673 | WordPress iZooto plugin <= 3.7.20 - Broken Access Control vulnerability |
| CVE-2026-39675 | WordPress Court Reservation plugin <= 1.10.11 - Broken Access Control vulnerability |
| CVE-2026-39676 | WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerability |
| CVE-2026-39678 | WordPress Pinpoint Booking System plugin <= 2.9.9.6.5 - Broken Access Control vulnerability |
| CVE-2026-39680 | WordPress Diet Calorie Calculator plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2026-39682 | WordPress linkPizza-Manager plugin <= 5.5.5 - Broken Access Control vulnerability |
| CVE-2026-39685 | WordPress The Moneytizer plugin <= 10.0.10 - Broken Access Control vulnerability |
| CVE-2026-39687 | WordPress Rapid Car Check Vehicle Data plugin <= 2.0 - Broken Access Control vulnerability |
| CVE-2026-39688 | WordPress WP Frontend Profile plugin <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2026-39689 | WordPress eShipper Commerce plugin <= 2.16.12 - Broken Access Control vulnerability |
| CVE-2026-39690 | WordPress Author Avatars List/Block plugin <= 2.1.25 - Broken Access Control vulnerability |
| CVE-2026-39691 | WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin <= 2.2.13 - Broken Access Control vulnerability |
| CVE-2026-39694 | WordPress Simply Schedule Appointments plugin <= 1.6.10.2 - Broken Access Control vulnerability |
| CVE-2026-39697 | WordPress MAIO – The new AI GEO / SEO tool plugin <= 6.2.8 - Broken Access Control vulnerability |
| CVE-2026-39698 | WordPress The Publisher Desk ads.txt plugin <= 1.5.0 - Broken Access Control vulnerability |
| CVE-2026-39699 | WordPress AI Workflow Automation plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2026-39700 | WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerability |
| CVE-2026-39701 | WordPress ShopWP plugin <= 5.2.4 - Broken Access Control vulnerability |
| CVE-2026-39704 | WordPress Precious Metals Automated Product Pricing – Pro plugin <= 4.0.5 - Broken Access Control vulnerability |
| CVE-2026-39705 | WordPress MIPL WC Multisite Sync plugin <= 1.4.4 - Broken Access Control vulnerability |
| CVE-2026-39706 | WordPress Make My Trivia plugin <= 1.1.0 - Broken Access Control vulnerability |
| CVE-2026-39707 | WordPress Accept PayPal Payments using Contact Form 7 plugin <= 4.0.4 - Broken Access Control vulnerability |
| CVE-2026-39713 | WordPress Mailercloud – Integrate webforms and synchronize website contacts plugin <= 1.0.7 - Broken Access Control vulnerabi... |
| CVE-2026-39714 | WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerability |
| CVE-2026-39715 | WordPress AnyTrack Affiliate Link Manager plugin <= 1.5.5 - Broken Access Control vulnerability |
| CVE-2026-39716 | WordPress Flipmart theme <= 2.8 - Broken Access Control vulnerability |
| CVE-2026-3977 | projectsend AJAX Endpoints authorization |
| CVE-2026-39816 | Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService |
| CVE-2026-39910 | STACKIT IaaS API Privilege Escalation via Service Account Attachment |
| CVE-2026-39914 | TIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint |
| CVE-2026-39967 | TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter |
| CVE-2026-4003 | Users manager – PN <= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Action |
| CVE-2026-40098 | OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclos... |
| CVE-2026-40117 | PraisonAIAgents Affected by Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate |
| CVE-2026-40132 | Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard) |
| CVE-2026-40133 | Missing Authorization check in SAP S/4HANA Condition Maintenance |
| CVE-2026-40134 | Missing Authorization Check in SAP Incentive and Commission Management |
| CVE-2026-40185 | Missing Authorization on Immich Trip Photo Routes in TREK |
| CVE-2026-40189 | goshs has a file-based ACL authorization bypass in goshs state-changing routes |
| CVE-2026-4019 | Complianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via... |
| CVE-2026-4024 | Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification |
| CVE-2026-40265 | Note Mark has Broken Access Control on Asset Download |
| CVE-2026-4029 | Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export |
| CVE-2026-4030 | Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion |
| CVE-2026-4031 | Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception |
| CVE-2026-40314 | NamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization |
| CVE-2026-40349 | Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true |
| CVE-2026-40375 | Microsoft Dynamics Business Central Information Disclosure Vulnerability |
| CVE-2026-4038 | Aimogen Pro <= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call |
| CVE-2026-40474 | wger has Broken Access Control in the Global Gym Configuration Update Endpoint |
| CVE-2026-40480 | ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}` |
| CVE-2026-40502 | OpenHarness Remote Administrative Command Injection via Gateway Handler |
| CVE-2026-40543 | Missing Authorization in SOPlanning |
| CVE-2026-4056 | User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulat... |
| CVE-2026-4057 | Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal |
| CVE-2026-40570 | FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII |
| CVE-2026-40571 | NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization |
| CVE-2026-4058 | User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Author... |
| CVE-2026-40581 | ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion |
| CVE-2026-40592 | FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply |
| CVE-2026-40601 | Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle |
| CVE-2026-40623 | SenseLive X3050 Missing Authorization |
| CVE-2026-4063 | Social Icons Widget & Block <= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation |
| CVE-2026-4064 | Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticat... |
| CVE-2026-4065 | Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipula... |
| CVE-2026-4066 | Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relat... |
| CVE-2026-40722 | WordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerability |
| CVE-2026-40723 | WordPress Bricks Builder theme <= 2.1.4 - Broken Access Control vulnerability |
| CVE-2026-40726 | WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability |
| CVE-2026-40728 | WordPress Magazine Blocks plugin <= 1.8.3 - Broken Access Control vulnerability |
| CVE-2026-40729 | WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability |
| CVE-2026-40730 | WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability |
| CVE-2026-40740 | WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability |
| CVE-2026-40741 | WordPress Redsys for WooCommerce Light plugin <= 7.0.0 - Broken Access Control vulnerability |
| CVE-2026-40742 | WordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerability |
| CVE-2026-40743 | WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability |
| CVE-2026-40763 | WordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability |
| CVE-2026-40773 | WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.9 - Broken Access Control vulnerability |
| CVE-2026-40774 | WordPress Booking Package plugin <= 1.7.06 - Broken Access Control vulnerability |
| CVE-2026-40775 | WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability |
| CVE-2026-40776 | WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability |
| CVE-2026-40778 | WordPress Majestic Support plugin <= 1.1.2 - Broken Access Control vulnerability |
| CVE-2026-40782 | WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability |
| CVE-2026-40786 | WordPress MyRewards plugin <= 5.7.3 - Broken Access Control vulnerability |
| CVE-2026-40788 | WordPress ChatBot plugin <= 7.9.7 - Broken Access Control vulnerability |
| CVE-2026-40793 | WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability |
| CVE-2026-40794 | WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2026-40795 | WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability |
| CVE-2026-40809 | WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability |
| CVE-2026-40870 | Decidim's comments API allows access to all commentable resources |
| CVE-2026-40937 | RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webh... |
| CVE-2026-4094 | FOX – Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configu... |
| CVE-2026-40976 | In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. Fo... |
| CVE-2026-4100 | Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Proc... |
| CVE-2026-41014 | Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints |
| CVE-2026-4109 | Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated... |
| CVE-2026-41128 | Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action |
| CVE-2026-41160 | EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes |
| CVE-2026-4117 | CalJ <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action |
| CVE-2026-4119 | Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion v... |
| CVE-2026-41192 | FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments |
| CVE-2026-4124 | Ziggeo <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Action |
| CVE-2026-41266 | Flowise: Sensitive Data Leak in public-chatbotConfig |
| CVE-2026-4127 | Speedup Optimization <= 1.5.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_en... |
| CVE-2026-4128 | TP Restore Categories And Taxonomies <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 't... |
| CVE-2026-4129 | Improper Access Controls in NI SystemLink |
| CVE-2026-41298 | OpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpoint |
| CVE-2026-41315 | mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Inject... |
| CVE-2026-41349 | OpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch |
| CVE-2026-41352 | OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass |
| CVE-2026-41378 | OpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch |
| CVE-2026-41382 | OpenClaw < 2026.3.31 - Discord Voice Ingress Authorization Bypass via Channel and Role Validation Gaps |
| CVE-2026-41394 | OpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes |
| CVE-2026-41454 | WeKan < 8.35 Missing Authorization via Integration REST API |
| CVE-2026-41464 | ProjeQtor < 12.4.4 Missing Authorization via objectDetail.php |
| CVE-2026-41477 | Deskflow: Local privilege escalation via unauthenticated IPC |
| CVE-2026-41498 | Kimai: Team API Missing Object-Level Authorization |
| CVE-2026-4162 | Gravity SMTP <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall |
| CVE-2026-41658 | Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items |
| CVE-2026-41679 | Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass |
| CVE-2026-41869 | Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API) |
| CVE-2026-41870 | Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API) |
| CVE-2026-41871 | Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API) |
| CVE-2026-4202 | Broken Access Control in extension "Redirect Tab" |
| CVE-2026-42051 | Kirby: System API endpoint leaks license data and installed version to authenticated users |
| CVE-2026-42069 | Kirby: Read access to site, user and role information is not gated by permissions |
| CVE-2026-42071 | MantisBT: Private Bugnote Attachment Content Leak via REST API |
| CVE-2026-42083 | free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and d... |
| CVE-2026-42137 | Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialo... |
| CVE-2026-42142 | TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access |
| CVE-2026-42174 | Kirby: User avatar creation, replacement and deletion are not gated by user update permissions |
| CVE-2026-42226 | n8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay |
| CVE-2026-42228 | n8n: Hijacking of Unauthenticated Chat Execution |
| CVE-2026-42297 | Argo Workflows Is Missing Authorization in Sync ConfigMap Provider |
| CVE-2026-42317 | GLPI vulnerable to arbitrary files deletion by technician |
| CVE-2026-42318 | GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint |
| CVE-2026-42320 | GLPI vulnerable to arbitrary file access |
| CVE-2026-42337 | MaxKB: Broken Access Control in MaxKB OSS URL Fetch API |
| CVE-2026-42377 | WordPress SureForms Pro plugin <= 2.8.0 - Broken Access Control vulnerability |
| CVE-2026-42412 | WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability |
| CVE-2026-42433 | OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools |
| CVE-2026-42436 | OpenClaw < 2026.4.14 - Internal Page Content Exposure via Browser Snapshot and Screenshot Routes |
| CVE-2026-42439 | OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes |
| CVE-2026-4244 | Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attr... |
| CVE-2026-42461 | Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) |
| CVE-2026-42541 | Kubewarden: RBAC Reconnaissance via unchecked can_i host capability call |
| CVE-2026-42569 | phpvms: /importer authorization bypass causing full database wipe |
| CVE-2026-4261 | Expire Users <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields |
| CVE-2026-42613 | Grav: Privilege Escalation via Missing Server-Side Validation of groups/access |
| CVE-2026-42640 | WordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerability |
| CVE-2026-42642 | WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability |
| CVE-2026-42648 | WordPress Spectra plugin <= 2.19.22 - Broken Access Control vulnerability |
| CVE-2026-42651 | WordPress Classified Listing plugin <= 5.3.9 - Broken Access Control vulnerability |
| CVE-2026-42659 | WordPress Advanced Form Integration plugin <= 1.126.12 - Broken Access Control vulnerability |
| CVE-2026-42664 | WordPress AI Product Search for WooCommerce – Motive Commerce Search plugin <= 1.38.2 - Broken Access Control vulnerability |
| CVE-2026-42666 | WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerability |
| CVE-2026-42669 | WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability |
| CVE-2026-42670 | WordPress Five Star Restaurant Reservations plugin <= 2.7.14 - Payment Bypass vulnerability |
| CVE-2026-42671 | WordPress GeoDirectory plugin <= 2.8.157 - Broken Access Control vulnerability |
| CVE-2026-42675 | WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability |
| CVE-2026-42677 | WordPress WP Document Revisions plugin <= 3.8.1 - Broken Access Control vulnerability |
| CVE-2026-42682 | WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability |
| CVE-2026-42726 | WordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Control vulnerability |
| CVE-2026-42753 | WordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerability |
| CVE-2026-42763 | WordPress SePay Gateway plugin <= 1.1.20 - Sensitive Data Exposure vulnerability |
| CVE-2026-4277 | Privilege abuse in GenericInlineModelAdmin |
| CVE-2026-42776 | WordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability |
| CVE-2026-42809 | Apache Polaris: staged table creation could vend storage credentials for unvalidated locations |
| CVE-2026-4281 | FormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via O... |
| CVE-2026-4283 | WP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users |
| CVE-2026-42851 | @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE |
| CVE-2026-4290 | WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators |
| CVE-2026-4292 | Privilege abuse in ModelAdmin.list_editable |
| CVE-2026-4297 | Welcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.... |
| CVE-2026-4298 | DSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset |
| CVE-2026-4299 | MainWP Child Reports <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via Heartbeat API |
| CVE-2026-4301 | Rate Star Review Vote <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating... |
| CVE-2026-4309 | Missing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a specific device informatio... |
| CVE-2026-4326 | Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and... |
| CVE-2026-4331 | Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Pos... |
| CVE-2026-43567 | OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter |
| CVE-2026-43568 | OpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint |
| CVE-2026-43572 | OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler |
| CVE-2026-43573 | OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes |
| CVE-2026-43575 | OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route |
| CVE-2026-43577 | OpenClaw < 2026.4.9 - Arbitrary File Read via Browser Interaction Routes |
| CVE-2026-43579 | OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes |
| CVE-2026-43580 | OpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions |
| CVE-2026-43583 | OpenClaw 2026.4.10 < 2026.4.14 - Loss of Group Tool-Policy Context in Delivery Queue Recovery |
| CVE-2026-4362 | ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite |
| CVE-2026-43638 | Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import |
| CVE-2026-43639 | Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients |
| CVE-2026-4365 | LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion |
| CVE-2026-43885 | WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization |
| CVE-2026-44010 | Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure |
| CVE-2026-44012 | Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure |
| CVE-2026-44125 | Missing Authorization in GINAv2 |
| CVE-2026-44176 | Kirby: `pages.access` permission is not checked during rendering of page drafts |
| CVE-2026-44281 | GLPI vulnerable to unauthorized reading of a specific asset object |
| CVE-2026-4431 | Easy Post Submission <= 2.3.0 - Missing Authorization |
| CVE-2026-44315 | free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions |
| CVE-2026-4432 | YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR |
| CVE-2026-44320 | free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path |
| CVE-2026-44321 | free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) |
| CVE-2026-44326 | free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and dele... |
| CVE-2026-44327 | free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler |
| CVE-2026-44328 | free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state... |
| CVE-2026-44329 | free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers |
| CVE-2026-44392 | Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privi... |
| CVE-2026-44442 | ERPNext: Unauthorised Document modification due to missing validation |
| CVE-2026-44448 | ERPNext: Unauthorised Document modification due to missing validation |
| CVE-2026-44482 | soundcloud-rpc: Remote Code Execution via XSS in Track Title |
| CVE-2026-44550 | Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts |
| CVE-2026-44554 | Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite |
| CVE-2026-44555 | Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining |
| CVE-2026-44556 | Open WebUI: responses passthrough endpoint lacks access control authorization |
| CVE-2026-44558 | Open WebUI: Channel Access Grants Bypass filter_allowed_access_grants |
| CVE-2026-44559 | Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels |
| CVE-2026-44560 | Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search |
| CVE-2026-44562 | Open WebUI: Model Import Overwrites Any Model Without Ownership Check |
| CVE-2026-44563 | Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show |
| CVE-2026-44569 | Open WebUI: Insecure Message Access Breaks Authorization |
| CVE-2026-44571 | Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission |
| CVE-2026-44585 | Paymenter: Broken object level authorization via service reference manipulation on ticket creation |
| CVE-2026-44592 | Gradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning |
| CVE-2026-44595 | Yamcs: Unauthorized user enumeration via IAM API endpoints |
| CVE-2026-44718 | Mathesar: Missing collaborator checks allowed access to saved explorations in other databases |
| CVE-2026-44719 | Mathesar: Missing collaborator checks allowed access to database-scoped Mathesar metadata |
| CVE-2026-44734 | OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT... |
| CVE-2026-44750 | Missing Authorization check in SAP MDG (Review Match Groups Application) |
| CVE-2026-44751 | Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform |
| CVE-2026-44754 | Missing caller identification check-in for ODP Data Replication APIs |
| CVE-2026-44764 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence |
| CVE-2026-44765 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence |
| CVE-2026-44770 | Missing Authorization check in SAP S/4 HANA (Create Single Payment) |
| CVE-2026-44771 | Missing Authorization check in SAP S/4HANA (Draft operation) |
| CVE-2026-44794 | Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference |
| CVE-2026-4484 | Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator |
| CVE-2026-44848 | Portainer: Missing authorization on Docker plugin endpoints allows host RCE |
| CVE-2026-44849 | Portainer: Endpoint security bypass via Swarm service create/update |
| CVE-2026-44884 | Portainer: Missing authorization on custom template file endpoint exposes template content |
| CVE-2026-44914 | Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents |
| CVE-2026-44918 | OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. |
| CVE-2026-44975 | Frappe: Missing authorization on reset form tours |
| CVE-2026-44994 | OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint |
| CVE-2026-45001 | OpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access |
| CVE-2026-45007 | phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure |
| CVE-2026-45085 | Discourse: Chat misauthorization and information disclosure |
| CVE-2026-45086 | Decidim: Forms admin question editor lacks authorization |
| CVE-2026-45124 | MyBB: Mod CP report resolution missing authorization |
| CVE-2026-45147 | SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk |
| CVE-2026-45209 | WordPress MyCryptoCheckout plugin <= 2.161 - Broken Access Control vulnerability |
| CVE-2026-45210 | WordPress Broadstreet Ads plugin <= 1.52.2 - Broken Access Control vulnerability |
| CVE-2026-45212 | WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.3 - Broken Access Control vulnerability |
| CVE-2026-45242 | Summarize < 0.15.1 Path Traversal via slidesDir Parameter |
| CVE-2026-45243 | Summarize < 0.15.1 Browser Extension Missing Authorization via Content Script |
| CVE-2026-45244 | Summarize < 0.15.1 Unapproved Browser Automation Execution |
| CVE-2026-45260 | Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling |
| CVE-2026-45267 | Nextcloud: Missing permission check for from submissions |
| CVE-2026-45273 | MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint |
| CVE-2026-45285 | Nextcloud: Hidden Public Link creation when sharing to a Team External Member |
| CVE-2026-45295 | FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoi... |
| CVE-2026-45330 | Decidim: Verification admins can access supplied IDs from other organisations |
| CVE-2026-45334 | Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions |
| CVE-2026-45350 | Open WebUI: Chat completion API allows tool restrictions to be bypassed |
| CVE-2026-45371 | SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs |
| CVE-2026-45395 | Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Executi... |
| CVE-2026-45399 | Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disrup... |
| CVE-2026-45415 | Decidim: CSV census record endpoints improper authorization |
| CVE-2026-45436 | WordPress WPBakery Page Builder plugin <= 8.7.2 - Broken Access Control vulnerability |
| CVE-2026-45438 | WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability |
| CVE-2026-45442 | WordPress Presto Player plugin <= 4.1.3 - Broken Access Control vulnerability |
| CVE-2026-45443 | WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 5.5.1 - Broken Access Control vulnerability |
| CVE-2026-45549 | Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host |
| CVE-2026-45550 | Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body |
| CVE-2026-45552 | Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server |
| CVE-2026-45625 | Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials a... |
| CVE-2026-45632 | Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution |
| CVE-2026-45667 | Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS) |
| CVE-2026-45677 | Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS |
| CVE-2026-45703 | Pimcore: WordExport Authorization Bypass for Unauthorized Document Export |
| CVE-2026-45704 | Pimcore: CustomReports Share Bypass |
| CVE-2026-45717 | Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowi... |
| CVE-2026-45730 | Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project |
| CVE-2026-4590 | kalcaddle kodbox loginSubmit API index.class.php cross-site request forgery |
| CVE-2026-4604 | Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update |
| CVE-2026-4607 | ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification |
| CVE-2026-4609 | ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining |
| CVE-2026-46365 | phpMyFAQ - Missing Authorization in Tag Deletion Endpoint |
| CVE-2026-46413 | Discourse: Regular users can route multipart uploads into the admin backup store |
| CVE-2026-46414 | Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking |
| CVE-2026-46425 | Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users |
| CVE-2026-46444 | Flowise: Vector Store No Permission Checks |
| CVE-2026-46459 | Missing Authorization in ICU Scandinavia Boomerang |
| CVE-2026-4650 | FundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status... |
| CVE-2026-46515 | Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution |
| CVE-2026-46518 | OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics |
| CVE-2026-46558 | Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in oth... |
| CVE-2026-46614 | Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an H... |
| CVE-2026-46645 | SQLAdmin: Authorization Bypass on `ajax_lookup` |
| CVE-2026-4666 | wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestpos... |
| CVE-2026-46716 | Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron |
| CVE-2026-4672 | Missing Authorization in GitLab |
| CVE-2026-4683 | Smartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update |
| CVE-2026-47089 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An... |
| CVE-2026-47100 | Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX |
| CVE-2026-47120 | Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) |
| CVE-2026-47125 | Arcane: Missing admin authorization on global variables endpoint |
| CVE-2026-47127 | Ghostfolio has a Stripe subscription bypass |
| CVE-2026-47129 | NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accou... |
| CVE-2026-47163 | Quest Bot: Unprivileged users can create and remove AutoMod rules. |
| CVE-2026-47193 | OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks |
| CVE-2026-47197 | Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands |
| CVE-2026-47226 | Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileg... |
| CVE-2026-47233 | Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 |
| CVE-2026-47281 | Visual Studio Code Elevation of Privilege Vulnerability |
| CVE-2026-47343 | TYPO3 CMS - Destructive Actions on File Mount Folders |
| CVE-2026-47346 | TYPO3 CMS - Broken Access Control in Form Framework |
| CVE-2026-47349 | TYPO3 CMS - Broken Access Control in Recycler |
| CVE-2026-47350 | TYPO3 CMS - Broken Access Control in DataHandler |
| CVE-2026-47351 | TYPO3 CMS - Broken Access Control in Clipboard |
| CVE-2026-47352 | TYPO3 CMS - Broken Access Control in Backend API |
| CVE-2026-47394 | PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate |
| CVE-2026-47405 | PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership |
| CVE-2026-47409 | praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/member... |
| CVE-2026-47411 | praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id} |
| CVE-2026-47412 | praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id} |
| CVE-2026-47413 | praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members |
| CVE-2026-47416 | praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/mem... |
| CVE-2026-47422 | Frappe: Unrestricted API access to save_report |
| CVE-2026-47625 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A succ... |
| CVE-2026-4764 | Privilege Escalation in Dialogflow CX via Playbook Import |
| CVE-2026-47657 | HumHub Missing Authorization on Remove All Space Members Action |
| CVE-2026-47688 | FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power sche... |
| CVE-2026-47718 | FUXA provides guest and invalid-token access to protected read APIs in secure mode |
| CVE-2026-47721 | FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions |
| CVE-2026-47724 | nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation |
| CVE-2026-47728 | Bugsink: Project scoping missing in sourcemap and debug-file lookup |
| CVE-2026-47740 | Shopper: Authorization bypass in multiple Livewire admin components |
| CVE-2026-47742 | Shopper: Missing authorization on Product admin Livewire sub-form components |
| CVE-2026-47745 | Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables |
| CVE-2026-47754 | unauthenticated path traversal in Metacat 2.x |
| CVE-2026-47755 | ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal |
| CVE-2026-47765 | Frappe: Lack of Permissions in restore/bulk_restore |
| CVE-2026-4795 | A missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware versi... |
| CVE-2026-48008 | Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass |
| CVE-2026-48014 | Shopware: Admin API ACL Bypass in Order State Transition Endpoints |
| CVE-2026-4807 | Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion |
| CVE-2026-48075 | OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections |
| CVE-2026-48077 | OpenReception: GET appointment by ID returns full appointment record without authorization |
| CVE-2026-48085 | OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap |
| CVE-2026-48088 | OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory |
| CVE-2026-48119 | Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services |
| CVE-2026-4812 | Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Fie... |
| CVE-2026-48127 | Frappe: Arbitrary Attachment Injection via add_attachments and upload_file |
| CVE-2026-48151 | Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema |
| CVE-2026-48168 | PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name |
| CVE-2026-48169 | PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API |
| CVE-2026-4818 | Some management operations on data streams are not properly restricted when user does not have the necessary privileges |
| CVE-2026-4843 | GSheet For Woo Importer <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset |
| CVE-2026-48492 | Snipe-IT's selectlist visibility is too permissive |
| CVE-2026-48495 | TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots |
| CVE-2026-48500 | Filament: Unauthenticated temporary file upload on auth pages |
| CVE-2026-48582 | Microsoft Exchange Online Elevation of Privilege Vulnerability |
| CVE-2026-48592 | Missing authorization check on save-job event handler in oban_web |
| CVE-2026-48709 | OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration |
| CVE-2026-48751 | Incus has a restricted project bypass leading to arbitrary command execution |
| CVE-2026-48763 | TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath |
| CVE-2026-48783 | Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription |
| CVE-2026-4879 | Missing Authorization in GitLab |
| CVE-2026-48797 | Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication |
| CVE-2026-48811 | FreeScout: Thread Deletion Bypasses Mailbox Access Revocation |
| CVE-2026-48835 | WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability |
| CVE-2026-48873 | WordPress Montonio for WooCommerce plugin <= 10.1.2 - Broken Access Control vulnerability |
| CVE-2026-4888 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authentica... |
| CVE-2026-48881 | WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerability |
| CVE-2026-48883 | WordPress WPC Product Bundles for WooCommerce plugin <= 8.5.3 - Broken Access Control vulnerability |
| CVE-2026-48887 | WordPress JS Help Desk plugin <= 3.0.9 - Broken Access Control vulnerability |
| CVE-2026-48941 | Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26 |
| CVE-2026-48969 | WordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerability |
| CVE-2026-48971 | WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability |
| CVE-2026-48973 | WordPress SVG Support plugin <= 2.5.14 - Broken Access Control vulnerability |
| CVE-2026-49045 | WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability |
| CVE-2026-49047 | WordPress DearFlip plugin <= 2.4.27 - Broken Access Control vulnerability |
| CVE-2026-49051 | WordPress WP Meta and Date Remover plugin <= 2.3.6 - Broken Access Control vulnerability |
| CVE-2026-49052 | WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability |
| CVE-2026-49053 | WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability |
| CVE-2026-49054 | WordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerability |
| CVE-2026-49057 | WordPress JobSearch plugin <= 3.2.7 - Broken Access Control vulnerability |
| CVE-2026-49065 | WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability |
| CVE-2026-49070 | WordPress Knit Pay plugin <= 9.4.0.0 - Broken Access Control vulnerability |
| CVE-2026-49072 | WordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerability |
| CVE-2026-49081 | WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability |
| CVE-2026-4916 | Missing Authorization in GitLab |
| CVE-2026-49205 | phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) |
| CVE-2026-4925 | Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-e... |
| CVE-2026-49258 | Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) |
| CVE-2026-49274 | Kirby: `pages.access` permission is not checked in the pages picker for parent pages |
| CVE-2026-49288 | Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources |
| CVE-2026-49291 | mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call |
| CVE-2026-49292 | Kiwi TCMS: The /init-db/ page renders and responds to requests after first use |
| CVE-2026-49326 | Apache HBase: Missing scanner instance owner check in thrift delegation service |
| CVE-2026-49357 | Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication |
| CVE-2026-49394 | Frappe: Auth. bypass via update_page |
| CVE-2026-49439 | OpenRemote read-only asset users can write predicted datapoints |
| CVE-2026-4949 | ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription |
| CVE-2026-4968 | SourceCodester Diary App diary.php cross-site request forgery |
| CVE-2026-4971 | SourceCodester Note Taking App cross-site request forgery |
| CVE-2026-49741 | TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework |
| CVE-2026-4977 | UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter |
| CVE-2026-49775 | WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability |
| CVE-2026-49782 | WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability |
| CVE-2026-49819 | UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd |
| CVE-2026-49821 | Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration |
| CVE-2026-49822 | Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance |
| CVE-2026-4986 | WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery |
| CVE-2026-49948 | Mem0 0.2.8 Missing Authorization via POST /configure Endpoint |
| CVE-2026-49956 | Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search |
| CVE-2026-49991 | RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection |
| CVE-2026-50006 | Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Serv... |
| CVE-2026-50007 | Actual: Shared users can perform owner-only file management actions |
| CVE-2026-50025 | Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state |
| CVE-2026-50026 | Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints |
| CVE-2026-50084 | Aqara API cross-account access |
| CVE-2026-50105 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) |
| CVE-2026-50108 | Naxclow IoT Platform Missing Authorization |
| CVE-2026-50137 | Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs u... |
| CVE-2026-5022 | Langflow - Missing Authorization on download_image Endpoint |
| CVE-2026-50222 | Apache CloudStack: Improper access control in Userdata reference APIs |
| CVE-2026-50244 | Naxclow IoT Platform Missing Authorization |
| CVE-2026-5025 | Langflow - Application Logs Exposed to All Authenticated Users |
| CVE-2026-50282 | Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves |
| CVE-2026-50283 | Craft CMS: Unauthorized Deletion of Source Assets During File Replacement |
| CVE-2026-50284 | Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets |
| CVE-2026-50622 | Apache Atlas: Missing Authorization on Admin Endpoints |
| CVE-2026-5093 | Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings' |
| CVE-2026-5139 | GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration |
| CVE-2026-5146 | Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to... |
| CVE-2026-5163 | Missing authorization check in AI message rewrite endpoint allows access to private thread content |
| CVE-2026-5175 | Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated... |
| CVE-2026-5200 | AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router' |
| CVE-2026-5228 | Improper Access Control in Kurt Software Studio's WriteUp Mobile App |
| CVE-2026-5230 | Improper Access Control in Mia Technologies' Pizzy Library |
| CVE-2026-52701 | WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability |
| CVE-2026-52711 | WordPress WooCommerce POS plugin <= 1.8.14 - Broken Access Control vulnerability |
| CVE-2026-52714 | WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.16 - Broken Access Control vulnerability |
| CVE-2026-52730 | Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence |
| CVE-2026-52766 | YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action |
| CVE-2026-52799 | Gogs: Missing Authorization in Attachment Download |
| CVE-2026-52812 | Gogs: LFS dedupe path leaks private repo content across tenants |
| CVE-2026-52821 | Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects |
| CVE-2026-52822 | Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation |
| CVE-2026-52825 | Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Au... |
| CVE-2026-52828 | Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access |
| CVE-2026-52839 | Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypas... |
| CVE-2026-52866 | Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Missing Authorization |
| CVE-2026-52870 | MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks |
| CVE-2026-52892 | Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops... |
| CVE-2026-5294 | GeekyBot <= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX A... |
| CVE-2026-5296 | Missing Authorization in GitLab |
| CVE-2026-53444 | Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin |
| CVE-2026-53445 | Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards |
| CVE-2026-53447 | Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID |
| CVE-2026-53453 | Blueprint Studio API authorization bypass for non-admin Home Assistant users |
| CVE-2026-5347 | WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter |
| CVE-2026-53487 | Kite has an authenticated cluster RBAC bypass in /api/v1/overview |
| CVE-2026-53514 | Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin |
| CVE-2026-53546 | Termix: Missing authorization in SSH host credential resolution exposes stored credentials |
| CVE-2026-53547 | Termix: Account Takeover via Global Settings Disclosure |
| CVE-2026-5356 | LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Bindin... |
| CVE-2026-53569 | Frappe: Missing authorization in toggle_like and mark_as_seen |
| CVE-2026-53602 | nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate |
| CVE-2026-53633 | Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE |
| CVE-2026-53634 | Sharp: Missing Authorization Check in Quick Creation Command Endpoints |
| CVE-2026-53635 | Open edX Platform: Insufficient Permission on set_course_mode_price() |
| CVE-2026-53640 | FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data |
| CVE-2026-53643 | FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints |
| CVE-2026-53647 | FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint |
| CVE-2026-5371 | MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin In... |
| CVE-2026-53718 | Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass |
| CVE-2026-53730 | DataEase: Unauthorized Access to Engine Database via previewSql Endpoint |
| CVE-2026-53769 | Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy |
| CVE-2026-53815 | OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions |
| CVE-2026-53816 | OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node |
| CVE-2026-53818 | OpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP Loopback |
| CVE-2026-53820 | OpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session Spawn |
| CVE-2026-53821 | OpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocket |
| CVE-2026-53844 | OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search |
| CVE-2026-53850 | OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command |
| CVE-2026-53851 | OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass |
| CVE-2026-53866 | OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing |
| CVE-2026-5387 | AVEVA Pipeline Simulation Missing Authorization |
| CVE-2026-53960 | Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD |
| CVE-2026-53966 | XWiki Platform: Privilege escalation from edit to script right through Live Data editing |
| CVE-2026-53996 | NetBSD hdaudio(4) Driver Privilege Bypass Use-After-Free via HDAUDIO_FGRP_SETCONFIG ioctl |
| CVE-2026-54004 | Kirby: Access to files of top-level drafts is not protected by permissions |
| CVE-2026-54005 | Kirby: `pages.access` permission is not checked in the `site/find` REST API route |
| CVE-2026-54010 | Open WebUI: Forged chat-file link allows cross-user file read and deletion |
| CVE-2026-54012 | Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion |
| CVE-2026-54019 | Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode |
| CVE-2026-54027 | LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization |
| CVE-2026-54029 | LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter |
| CVE-2026-54052 | n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments |
| CVE-2026-54076 | ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) |
| CVE-2026-54168 | Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task... |
| CVE-2026-54190 | WordPress Envira Photo Gallery plugin <= 1.12.5 - Broken Access Control vulnerability |
| CVE-2026-54201 | TeamDavid: Missing Authorization |
| CVE-2026-54237 | Wavelog: Unauthenticated Remote Code Execution |
| CVE-2026-5427 | Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block At... |
| CVE-2026-54322 | Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles |
| CVE-2026-54329 | Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API |
| CVE-2026-54356 | Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url` |
| CVE-2026-54415 | Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover |
| CVE-2026-54418 | Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass |
| CVE-2026-54475 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover |
| CVE-2026-54509 | TREK IDOR: any authenticated user can read another user's journey share token (full journey leak) |
| CVE-2026-54519 | AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion |
| CVE-2026-54523 | Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBin... |
| CVE-2026-54568 | Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info |
| CVE-2026-54569 | SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorizatio... |
| CVE-2026-54608 | MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up |
| CVE-2026-54624 | django CMS: Structure endpoint bypasses page-view permission |
| CVE-2026-54628 | Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode |
| CVE-2026-54629 | Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode |
| CVE-2026-5464 | ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process |
| CVE-2026-54643 | CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php |
| CVE-2026-54648 | CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion |
| CVE-2026-54671 | WeGIA: Authorization Bypass via Empty Resource Array in InternoControle |
| CVE-2026-54676 | Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled |
| CVE-2026-54677 | Scoold: Authenticated user can post replies and comments to private-space questions without space membership |
| CVE-2026-54695 | Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID |
| CVE-2026-54719 | goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-202... |
| CVE-2026-54740 | Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators |
| CVE-2026-54741 | Lemmy: Blocked users can edit private messages sent before the block |
| CVE-2026-54746 | Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe |
| CVE-2026-54802 | WordPress SMS Alert Order Notifications plugin <= 3.9.3 - Broken Authentication vulnerability |
| CVE-2026-54810 | WordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerability |
| CVE-2026-54828 | WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerability |
| CVE-2026-54830 | WordPress Five Star Restaurant Reservations plugin <= 2.7.19 - Broken Access Control vulnerability |
| CVE-2026-54832 | WordPress Gutenverse Companion plugin <= 2.5.0 - Broken Access Control vulnerability |
| CVE-2026-54835 | WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability |
| CVE-2026-54837 | WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability |
| CVE-2026-54840 | WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability |
| CVE-2026-54842 | WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability |
| CVE-2026-54844 | WordPress CheckView Automated Testing plugin <= 2.1.0 - Broken Access Control vulnerability |
| CVE-2026-54846 | WordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability |
| CVE-2026-54847 | WordPress Stylish Cost Calculator plugin <= 8.3.9 - Broken Access Control vulnerability |
| CVE-2026-5488 | ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Actio... |
| CVE-2026-5502 | Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order |
| CVE-2026-55052 | Microsoft SharePoint Elevation of Privilege Vulnerability |
| CVE-2026-55064 | Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project... |
| CVE-2026-55095 | OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields |
| CVE-2026-55106 | authentik: Unauthenticated LDAP directory data disclosure |
| CVE-2026-55178 | GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster... |
| CVE-2026-55188 | RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials |
| CVE-2026-55189 | RustFS: FTP frontend skips IAM authorization on object reads |
| CVE-2026-55417 | Chevereto private profile setting leaks username on /json endpoint |
| CVE-2026-55432 | Coder's sub-agent app registration bypasses template port-sharing policy enforcement |
| CVE-2026-55433 | Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers |
| CVE-2026-55440 | Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service |
| CVE-2026-55476 | Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter |
| CVE-2026-55483 | Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation |
| CVE-2026-55518 | Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Esc... |
| CVE-2026-55521 | Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API |
| CVE-2026-55528 | praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862) |
| CVE-2026-55530 | PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation to... |
| CVE-2026-55541 | PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced |
| CVE-2026-55542 | Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL |
| CVE-2026-55544 | NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering |
| CVE-2026-55545 | Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce |
| CVE-2026-55547 | Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Secur... |
| CVE-2026-55548 | Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets |
| CVE-2026-55550 | NextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog |
| CVE-2026-55628 | ImageMagick: Policy Bypass in concatenate operation due to missing checks |
| CVE-2026-55638 | 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass |
| CVE-2026-55658 | Gardens v2: StreamingEscrow buffer drains to the proposal beneficiary on cancel via the permissionless claim() |
| CVE-2026-55703 | Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET |
| CVE-2026-55704 | Discourse: Shared-draft titles and excerpts leak through group post serialization |
| CVE-2026-5572 | Technostrobe HI-LED-WR120-G2 cross-site request forgery |
| CVE-2026-5574 | Technostrobe HI-LED-WR120-G2 FsBrowseClean deletefile authorization |
| CVE-2026-55762 | Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fing... |
| CVE-2026-5581 | Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion |
| CVE-2026-55838 | RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics |
| CVE-2026-55863 | motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution |
| CVE-2026-56023 | WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Control vulnerability |
| CVE-2026-56025 | WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability |
| CVE-2026-56038 | WordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability |
| CVE-2026-56061 | WordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability |
| CVE-2026-56063 | WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability |
| CVE-2026-56092 | Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-56100 | SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint |
| CVE-2026-56104 | Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration |
| CVE-2026-56115 | Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass |
| CVE-2026-56213 | Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC |
| CVE-2026-5624 | ProjectSend upload.php cross-site request forgery |
| CVE-2026-56250 | Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions |
| CVE-2026-5626 | Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export |
| CVE-2026-56279 | Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint |
| CVE-2026-56280 | Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect |
| CVE-2026-56341 | AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php |
| CVE-2026-56384 | Craft CMS - Missing Authorization in assets/preview-thumb Endpoint |
| CVE-2026-56396 | phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights() |
| CVE-2026-56402 | NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler |
| CVE-2026-56423 | MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk dele... |
| CVE-2026-56424 | Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event rep... |
| CVE-2026-56668 | ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange |
| CVE-2026-56695 | OpenHarness - Cross-Session Disclosure via /resume and /summary Commands |
| CVE-2026-56696 | OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands |
| CVE-2026-56707 | Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode |
| CVE-2026-56720 | CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action |
| CVE-2026-56742 | Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces |
| CVE-2026-56767 | Maxun < 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API Handlers |
| CVE-2026-56768 | Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method |
| CVE-2026-56773 | Teable - Missing Authorization in v2 REST API |
| CVE-2026-56825 | Shopper: Missing authorization on product removal actions in CollectionProducts component |
| CVE-2026-56827 | Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggl... |
| CVE-2026-56829 | Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component |
| CVE-2026-56830 | Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization |
| CVE-2026-5693 | Smart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking Cancellation |
| CVE-2026-57112 | PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools |
| CVE-2026-57131 | praisonai: Jobs API exposes agent-execution endpoints with no authentication |
| CVE-2026-57137 | PraisonAI AgentLoop onToolCall approval runs after tool execution |
| CVE-2026-57139 | PraisonAI MCPServer exposes unauthenticated HTTP tools/call |
| CVE-2026-57205 | SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints |
| CVE-2026-57206 | SimpleChat plugin validation endpoints missing authentication and authorization |
| CVE-2026-57221 | RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users |
| CVE-2026-57323 | WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability |
| CVE-2026-57324 | WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2026-57327 | WordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability |
| CVE-2026-57332 | WordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerability |
| CVE-2026-57334 | WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability |
| CVE-2026-57335 | WordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2026-57339 | WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability |
| CVE-2026-57340 | WordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerability |
| CVE-2026-57353 | WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability |
| CVE-2026-57355 | WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability |
| CVE-2026-57367 | WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability |
| CVE-2026-57375 | WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability |
| CVE-2026-57377 | WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability |
| CVE-2026-57378 | WordPress Advanced Forms plugin <= 1.9.3.7 - Broken Access Control vulnerability |
| CVE-2026-57390 | WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability |
| CVE-2026-57392 | WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability |
| CVE-2026-57395 | WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability |
| CVE-2026-57400 | WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability |
| CVE-2026-57404 | WordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerability |
| CVE-2026-57405 | WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability |
| CVE-2026-57406 | WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability |
| CVE-2026-57408 | WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability |
| CVE-2026-57412 | WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability |
| CVE-2026-57418 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability |
| CVE-2026-57419 | WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability |
| CVE-2026-57424 | WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability |
| CVE-2026-57425 | WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability |
| CVE-2026-57429 | WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability |
| CVE-2026-57430 | WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability |
| CVE-2026-57494 | AgenticMail: Cross-agent task authorization bypass in AgenticMail API |
| CVE-2026-57498 | Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers |
| CVE-2026-57518 | Pagekit CMS 1.0.18 Privilege Escalation via UserApiController |
| CVE-2026-57520 | Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint |
| CVE-2026-57521 | Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController |
| CVE-2026-5753 | All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup S... |
| CVE-2026-57570 | backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation |
| CVE-2026-57578 | DotVVM: Missing authorization in AuthorizeActionFilter |
| CVE-2026-57579 | Alchemy: Unauthenticated nested page API leaks restricted & unpublished content |
| CVE-2026-57619 | WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability |
| CVE-2026-57622 | WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability |
| CVE-2026-57632 | WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerability |
| CVE-2026-57640 | WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability |
| CVE-2026-57645 | WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability |
| CVE-2026-57648 | WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability |
| CVE-2026-57649 | WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability |
| CVE-2026-57654 | WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability |
| CVE-2026-57660 | WordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerability |
| CVE-2026-57661 | WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerability |
| CVE-2026-57669 | WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability |
| CVE-2026-57685 | WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerability |
| CVE-2026-57688 | WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability |
| CVE-2026-57689 | WordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerability |
| CVE-2026-57703 | WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability |
| CVE-2026-57705 | WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability |
| CVE-2026-57717 | WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability |
| CVE-2026-57720 | WordPress ThumbPress plugin <= 6.3.2 - Broken Access Control vulnerability |
| CVE-2026-57721 | WordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerability |
| CVE-2026-57727 | WordPress Kirki plugin <= 6.0.13 - Broken Access Control vulnerability |
| CVE-2026-57729 | WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability |
| CVE-2026-57730 | WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability |
| CVE-2026-57731 | WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability |
| CVE-2026-57740 | WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability |
| CVE-2026-57746 | WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability |
| CVE-2026-57750 | WordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerability |
| CVE-2026-57760 | WordPress Sendcloud Shipping plugin <= 1.0.29 - Broken Access Control vulnerability |
| CVE-2026-57774 | WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability |
| CVE-2026-57776 | WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability |
| CVE-2026-57778 | WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability |
| CVE-2026-57779 | WordPress Fascinate theme <= 1.1.5 - Broken Access Control vulnerability |
| CVE-2026-57781 | WordPress MeetingHub plugin <= 1.25.10 - Broken Access Control vulnerability |
| CVE-2026-57782 | WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability |
| CVE-2026-57797 | WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability |
| CVE-2026-57808 | WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability |
| CVE-2026-57812 | WordPress Simply Schedule Appointments plugin <= 1.6.12.4 - Broken Access Control vulnerability |
| CVE-2026-57830 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 |
| CVE-2026-57850 | RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection |
| CVE-2026-57886 | Cross-repository issue/comment attachment re-linking can expose private attachment content |
| CVE-2026-57946 | Invidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint |
| CVE-2026-57949 | ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint |
| CVE-2026-57952 | Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID |
| CVE-2026-57954 | Elide 7.1.17 - Permission Bypass in Sort Expression Validation |
| CVE-2026-58080 | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On serv... |
| CVE-2026-58165 | OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation |
| CVE-2026-58167 | Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users |
| CVE-2026-58168 | DeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users |
| CVE-2026-58176 | RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints |
| CVE-2026-58237 | Multiple vulnerabilities in SAP Business AI Platform (Approuter) |
| CVE-2026-58241 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration... |
| CVE-2026-58243 | Privilege Escalation vulnerability in SAP ABAP Developer Tools |
| CVE-2026-58244 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII) |
| CVE-2026-58275 | Azure DNS Elevation of Privilege Vulnerability |
| CVE-2026-58279 | Azure CycleCloud Elevation of Privilege Vulnerability |
| CVE-2026-58373 | CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence |
| CVE-2026-58377 | JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys |
| CVE-2026-58408 | ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII |
| CVE-2026-58410 | ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records |
| CVE-2026-58432 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical R... |
| CVE-2026-58433 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting |
| CVE-2026-58434 | Private Repository Metadata Remains Accessible After Access Revocation |
| CVE-2026-58438 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot acces... |
| CVE-2026-58448 | yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API |
| CVE-2026-58473 | Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings |
| CVE-2026-58482 | Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions |
| CVE-2026-58562 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker... |
| CVE-2026-58565 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker... |
| CVE-2026-58589 | FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067 |
| CVE-2026-58590 | FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068 |
| CVE-2026-59097 | Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets |
| CVE-2026-59113 | Visual Studio Code Remote Code Execution Vulnerability |
| CVE-2026-59216 | Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id |
| CVE-2026-59217 | Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to K... |
| CVE-2026-59225 | Open WebUI: Arena task endpoints can bypass underlying model access controls |
| CVE-2026-59226 | Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation |
| CVE-2026-59227 | Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission |
| CVE-2026-59255 | BloodHound Missing Authorization on Custom Node Management API |
| CVE-2026-59262 | AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field |
| CVE-2026-5944 | Cisco Intersight Device Connector for Nutanix Prism Central Unauthenticated API Access |
| CVE-2026-59522 | WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability |
| CVE-2026-59523 | WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability |
| CVE-2026-59529 | WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability |
| CVE-2026-59530 | WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability |
| CVE-2026-59534 | WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability |
| CVE-2026-59535 | WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability |
| CVE-2026-59536 | WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability |
| CVE-2026-59547 | WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability |
| CVE-2026-59557 | WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability |
| CVE-2026-59560 | WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability |
| CVE-2026-59677 | Process Kill Attack Vector in killall() in seunshare |
| CVE-2026-59690 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorizat... |
| CVE-2026-59704 | Cap - Missing Access Control in Video AI Metadata Endpoint |
| CVE-2026-59708 | Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint |
| CVE-2026-59709 | Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check |
| CVE-2026-59714 | Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids) |
| CVE-2026-59739 | Apache ZooKeeper: Information disclosure via SetWatches reconnect replay |
| CVE-2026-59805 | Gumroad < 2026.07.06.2 - Insecure Direct Object Reference in PurchasesController |
| CVE-2026-59829 | Discourse: Review queue exposes flag-related private message excerpts to category group moderators |
| CVE-2026-59853 | SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access... |
| CVE-2026-59992 | Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) |
| CVE-2026-60118 | Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint |
| CVE-2026-60119 | Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection |
| CVE-2026-60124 | MISP importModule missing authorization allows read-only users to modify events via misp_standard imports |
| CVE-2026-6079 | Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion |
| CVE-2026-6109 | FoundationAgents MetaGPT Mineflayer HTTP API index.js evaluateCode cross-site request forgery |
| CVE-2026-61410 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Mis... |
| CVE-2026-61440 | PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints |
| CVE-2026-61441 | PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies |
| CVE-2026-61442 | PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH |
| CVE-2026-6145 | User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Paramet... |
| CVE-2026-61549 | Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend |
| CVE-2026-61592 | djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capabilit... |
| CVE-2026-61594 | djust has an authorization bypass on the WebSocket/SSE mount path |
| CVE-2026-61595 | djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data |
| CVE-2026-61596 | djust has broken object-level access control (IDOR) |
| CVE-2026-61663 | django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privile... |
| CVE-2026-61718 | bunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes |
| CVE-2026-61936 | Windows Defender Firewall Service Security Feature Bypass Vulnerability |
| CVE-2026-61943 | WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability |
| CVE-2026-61952 | WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability |
| CVE-2026-61954 | WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability |
| CVE-2026-61958 | WordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerability |
| CVE-2026-61968 | WordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerability |
| CVE-2026-61972 | WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability |
| CVE-2026-61973 | WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability |
| CVE-2026-61978 | WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability |
| CVE-2026-61983 | WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability |
| CVE-2026-61984 | WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability |
| CVE-2026-61985 | WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability |
| CVE-2026-62089 | WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability |
| CVE-2026-62114 | WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability |
| CVE-2026-62132 | WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability |
| CVE-2026-62135 | WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability |
| CVE-2026-62136 | WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerabi... |
| CVE-2026-62137 | WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability |
| CVE-2026-6214 | Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via formin... |
| CVE-2026-62186 | OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override |
| CVE-2026-62191 | OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations |
| CVE-2026-62194 | OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install |
| CVE-2026-62205 | OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions |
| CVE-2026-62206 | OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions |
| CVE-2026-62207 | OpenClaw < 2026.6.5 Authentication Bypass via Admin Tools |
| CVE-2026-62218 | OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve |
| CVE-2026-6222 | Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'formi... |
| CVE-2026-62232 | Grav < 2.0.4 2FA Bypass via Secret Regeneration |
| CVE-2026-62233 | grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey |
| CVE-2026-62235 | Grav Flex-Objects < 1.4.3 Authorization Bypass via API |
| CVE-2026-62283 | Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check |
| CVE-2026-62328 | 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints |
| CVE-2026-62348 | TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations |
| CVE-2026-6235 | Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests |
| CVE-2026-62666 | Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA... |
| CVE-2026-62667 | Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL |
| CVE-2026-62670 | Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directo... |
| CVE-2026-62830 | Azure SRE Agent Elevation of Privilege Vulnerability |
| CVE-2026-62861 | TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain |
| CVE-2026-62915 | Microsoft Exchange Server Security Feature Bypass Vulnerability |
| CVE-2026-62940 | Incus has a project restriction bypass via instance migration config override |
| CVE-2026-63003 | django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass... |
| CVE-2026-63082 | Perfect Support Ticketing System 1.7 Broken Access Control via Agent Assignment |
| CVE-2026-63092 | kirby-modules License Key Disclosure via modules/activate Dialog |
| CVE-2026-63100 | Maybe 0.6.0 Missing Authorization via HostingsController show/update |
| CVE-2026-63141 | Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions |
| CVE-2026-63143 | Missing Authorization in Kibana Leading to Unauthorized Information Disclosure |
| CVE-2026-63219 | Unauthenticated file upload via missing authorization on formatter upload endpoint |
| CVE-2026-63248 | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymo... |
| CVE-2026-63262 | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-63300 | Cross-project instance move bypasses all project restrictions allowing host command execution |
| CVE-2026-63464 | Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` |
| CVE-2026-63669 | ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank p... |
| CVE-2026-6372 | WordPress Accept Cryptocurrencies with Plisio plugin <= 2.0.5 - Payment Bypass vulnerability |
| CVE-2026-63741 | SurrealDB before 3.1.0 Authentication Bypass via USE statement |
| CVE-2026-63758 | SurrealDB before 3.1.0 Authorization Bypass via KILL Statement |
| CVE-2026-6393 | BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage |
| CVE-2026-6441 | Canto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification |
| CVE-2026-64622 | Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox |
| CVE-2026-64662 | Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries |
| CVE-2026-64664 | Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence |
| CVE-2026-64676 | Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory |
| CVE-2026-6470 | PostgreSQL fails to check type USAGE privilege |
| CVE-2026-6471 | PostgreSQL logical decoding can dlopen arbitrary file |
| CVE-2026-6472 | PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege |
| CVE-2026-64852 | Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account |
| CVE-2026-64866 | New API: Admin can reset passkeys for same-level or higher-privileged users |
| CVE-2026-64954 | Velociraptor collect_client() Permissions Bypass |
| CVE-2026-64965 | Missing Authorization Check in ATutor |
| CVE-2026-65007 | Grav before 1.0.8 Missing Authorization on API Key Generation |
| CVE-2026-65011 | Graylog2 Server Missing Permission Check on Event Definition Duplicate |
| CVE-2026-65050 | Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors |
| CVE-2026-65055 | Taiga taiga-back Private Project Member Roster Disclosure via Unauthenticated filters_data Endpoints |
| CVE-2026-6506 | InfusedWoo Pro <= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta U... |
| CVE-2026-6509 | Privilege Escalation in TUBITAK BILGEM's Pardus Update |
| CVE-2026-6510 | InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe' |
| CVE-2026-6512 | InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters |
| CVE-2026-65433 | WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control vulnerability |
| CVE-2026-65435 | WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability |
| CVE-2026-65445 | WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability |
| CVE-2026-65452 | WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability |
| CVE-2026-65453 | WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability |
| CVE-2026-65457 | WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability |
| CVE-2026-65468 | WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability |
| CVE-2026-65469 | WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability |
| CVE-2026-65472 | WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability |
| CVE-2026-65476 | WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability |
| CVE-2026-65478 | WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability |
| CVE-2026-65479 | WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability |
| CVE-2026-65484 | WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability |
| CVE-2026-65485 | WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability |
| CVE-2026-65486 | WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability |
| CVE-2026-65487 | WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability |
| CVE-2026-65489 | WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability |
| CVE-2026-65491 | WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability |
| CVE-2026-65495 | WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability |
| CVE-2026-65499 | WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability |
| CVE-2026-65500 | WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerabi... |
| CVE-2026-65504 | WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability |
| CVE-2026-65506 | WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability |
| CVE-2026-65524 | WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability |
| CVE-2026-65525 | WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2026-65529 | WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability |
| CVE-2026-65530 | WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability |
| CVE-2026-65531 | WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability |
| CVE-2026-65537 | WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability |
| CVE-2026-65541 | WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2026-65551 | WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability |
| CVE-2026-65554 | WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability |
| CVE-2026-65567 | WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability |
| CVE-2026-65568 | WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability |
| CVE-2026-65667 | Microsoft Teams Elevation of Privilege Vulnerability |
| CVE-2026-65675 | CoPilot Chat Security Feature Bypass Vulnerability |
| CVE-2026-65806 | Azure CycleCloud Information Disclosure Vulnerability |
| CVE-2026-6589 | ComfyUI server.py create_origin_only_middleware cross-site request forgery |
| CVE-2026-65895 | Grav API Plugin before 1.0.10 Broken Access Control |
| CVE-2025-66159 | WordPress Walker for Elementor plugin <= 1.1.6 - Broken Access Control vulnerability |
| CVE-2025-66160 | WordPress Select Graphist for Elementor Graphist for Elementor plugin <= 1.2.10 - Broken Access Control vulnerability |
| CVE-2025-66161 | WordPress Grider for Elementor plugin <= 1.0.8 - Broken Access Control vulnerability |
| CVE-2025-66162 | WordPress Spoter for Elementor plugin <= 1.04 - Broken Access Control vulnerability |
| CVE-2025-66163 | WordPress Masker for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2025-66164 | WordPress Laser plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2025-66165 | WordPress Lottier for WPBakery plugin <= 1.1.7 - Broken Access Control vulnerability |
| CVE-2025-66166 | WordPress Lottier for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2025-66167 | WordPress Lottier plugin <= 1.1.1 - Broken Access Control vulnerability |
| CVE-2025-7133 | CodeAstro Online Movie Ticket Booking System cross-site request forgery |
| CVE-2025-7499 | BetterDocs <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosure |
| CVE-2025-7663 | Ovatheme Events Manager <= 1.8.6 - Missing Authorization |
| CVE-2025-7664 | Al Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function |
| CVE-2025-7665 | Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation |
| CVE-2025-7689 | Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_passw... |
| CVE-2025-7695 | Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_passw... |
| CVE-2025-7717 | File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089 |
| CVE-2025-7756 | code-projects E-Commerce Site cross-site request forgery |
| CVE-2025-7772 | Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 16.8 - Missing Authorization to Authenticated (Subscrib... |
| CVE-2025-7782 | WP JobHunt <= 7.7 - Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status' |
| CVE-2025-7956 | Ajax Search Lite <= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search... |
| CVE-2025-8059 | B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function |
| CVE-2025-8152 | WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status... |
| CVE-2025-8268 | Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion |
| CVE-2025-8285 | Unauthorized Channel Subscription Creation in Mattermost Confluence Plugin |
| CVE-2025-8310 | Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a rem... |
| CVE-2025-8322 | Ventem｜e-School - Missing Authorization |
| CVE-2025-8434 | code-projects Online Movie Streaming admin.php authorization |
| CVE-2025-8435 | code-projects Online Movie Streaming admin-control.php authorization |
| CVE-2025-8446 | Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install |
| CVE-2025-8482 | Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration |
| CVE-2025-8487 | Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation |
| CVE-2025-8488 | Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated... |
| CVE-2025-8492 | Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution |
| CVE-2025-8505 | 495300897 wx-shop cross-site request forgery |
| CVE-2025-8778 | NitroPack <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compress... |
| CVE-2025-8796 | LitmusChaos Litmus Delete Request delete_project authorization |
| CVE-2025-8807 | xujeff tianti 天梯 save authorization |
| CVE-2025-8814 | atjiu pybbs CookieUtil.java setCookie cross-site request forgery |
| CVE-2025-8992 | mtons mblog cross-site request forgery |
| CVE-2025-8996 | Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097 |
| CVE-2025-8999 | Sydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update |
| CVE-2025-9018 | Time Tracker <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deleti... |
| CVE-2025-9029 | WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authenti... |
| CVE-2025-9049 | Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via A... |
| CVE-2025-9054 | MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Op... |
| CVE-2025-9076 | Mattermost Server exposes sensitive user credentials during shared channel membership synchronization |
| CVE-2025-9331 | Spacious <= 1.9.11 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import |
| CVE-2025-9825 | Missing Authorization in GitLab |
| CVE-2026-0572 | WebPurify Profanity Filter <= 4.0.2 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_opti... |
| CVE-2026-0593 | WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Mod... |
| CVE-2026-0635 | Responsive Accordion Slider <= 1.2.2 - Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordio... |
| CVE-2026-0656 | iPaymu Payment Gateway for WooCommerce <= 2.0.2 - Missing Authentication to Unauthenticated Payment Bypass and Order Informat... |
| CVE-2026-0674 | WordPress Campaign Monitor for WordPress plugin <= 2.9.1 - Broken Access Control vulnerability |
| CVE-2026-0676 | WordPress Zorka theme <= 1.5.7 - Broken Access Control vulnerability |
| CVE-2025-8565 | Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to... |
| CVE-2025-8593 | GSheetConnector For Gravity Forms <= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installat... |
| CVE-2025-8595 | Zakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo Import |
| CVE-2025-8682 | Newsup <= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation |
| CVE-2025-8712 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Ga... |
| CVE-2025-8739 | zhenfeng13 My-Blog save cross-site request forgery |
| CVE-2025-8886 | Authorization Bypass in Usta Information Systems' Aybs Interaktif |
| CVE-2025-8887 | IDOR in Usta Information Systems' Aybs Interaktif |
| CVE-2025-8898 | Taxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Acc... |
| CVE-2025-9133 | A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmwar... |
| CVE-2025-9194 | Constructor <= 1.6.5 - Missing Authorization to Authenticated (Subscriber+) Theme Clean |
| CVE-2025-9202 | ColorMag <= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation |
| CVE-2025-9218 | rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure... |
| CVE-2025-9219 | Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update |
| CVE-2025-9243 | Cost Calculator Builder <= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status F... |
| CVE-2025-9266 | Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation |
| CVE-2025-9542 | AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions |
| CVE-2025-9544 | Doppler Forms <= 2.5.1 - Subscriber+ Limited Plugin Installation |
| CVE-2025-9549 | Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099 |
| CVE-2026-0272 | PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI) |
| CVE-2026-0486 | Missing Authorization Check in ABAP based SAP systems |
| CVE-2026-0488 | Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor) |
| CVE-2026-0490 | Denial of service (DOS) in SAP BusinessObjects BI Platform |
| CVE-2026-0497 | Missing Authorization check in Business Server Pages Application (Product Designer Web UI) |
| CVE-2026-0503 | Missing Authorization check in in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) |
| CVE-2026-0506 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform |
| CVE-2026-0509 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform |
| CVE-2026-0511 | Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) |
| CVE-2026-0548 | Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Atta... |
| CVE-2026-0554 | NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset |
| CVE-2026-10085 | Ordinary group/direct message member can enable group_constrained and remove all channel participants |
| CVE-2026-10609 | Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf... |
| CVE-2026-10616 | nextlevelbuilder GoClaw Team Task Completion team_tasks_lifecycle.go TeamTasksTool.executeComplete authorization |
| CVE-2026-10627 | Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private',... |
| CVE-2026-10628 | Points and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification vi... |
| CVE-2026-10715 | Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint |
| CVE-2026-10737 | SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via vi... |
| CVE-2026-10750 | Royal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools |
| CVE-2026-10768 | LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039 |
| CVE-2026-10779 | Classified Listing <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Han... |
| CVE-2026-1142 | PHPGurukul News Portal cross-site request forgery |
| CVE-2026-11446 | Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization |
| CVE-2026-1153 | technical-laohu mpay cross-site request forgery |
| CVE-2026-11565 | Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui |
| CVE-2026-11575 | PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback |
| CVE-2026-11592 | Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via i... |
| CVE-2026-11600 | Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private... |
| CVE-2026-11607 | TYPO3 CMS - Broken Access Control in Form Framework |
| CVE-2026-1169 | birkir prime cross-site request forgery |
| CVE-2026-11719 | An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement acro... |
| CVE-2026-11773 | Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification |
| CVE-2026-1217 | Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite |
| CVE-2026-12238 | WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation |
| CVE-2026-12270 | Everest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints |
| CVE-2026-12349 | Premium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Del... |
| CVE-2026-1239 | Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endp... |
| CVE-2026-12396 | WP Job Portal < 2.5.5 - Subscriber+ Arbitrary Job Approval, Featuring and Rejection |
| CVE-2026-12404 | NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class |
| CVE-2026-12406 | User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter |
| CVE-2026-12407 | E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'scree... |
| CVE-2026-12411 | Broken Access Control in Canonical LXD DevLXD API |
| CVE-2026-12428 | Blocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'i... |
| CVE-2026-12432 | Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paym... |
| CVE-2026-12434 | List category posts <= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'pos... |
| CVE-2026-12435 | Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_so... |
| CVE-2026-12471 | Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation |
| CVE-2026-12472 | Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'ema... |
| CVE-2026-12500 | WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update |
| CVE-2026-68971 | Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints |
| CVE-2026-68979 | Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates |
| CVE-2026-69090 | Admidio before 5.0.11 Cross-Organization Role Modification |
| CVE-2026-69104 | Potential unauthorized repository migration in JFrog Artifactory |
| CVE-2026-69107 | Potential unauthorized artifact access in JFrog Artifactory |
| CVE-2026-69113 | Cap v0.3.1 Broken Access Control via video comment endpoint |
| CVE-2026-69115 | OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints |
| CVE-2026-69146 | MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth |
| CVE-2026-69148 | MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id |
| CVE-2026-69189 | Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers |
| CVE-2026-69197 | Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion |
| CVE-2026-69724 | Microsoft Office SharePoint Remote Code Execution Vulnerability |
| CVE-2026-70178 | Microsoft Fabric Elevation of Privilege Vulnerability |
| CVE-2026-70473 | Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history |
| CVE-2026-70475 | Flowise: Missing Authorization on Execution Update Endpoint |
| CVE-2026-70481 | Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages |
| CVE-2026-70483 | Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint |
| CVE-2026-70484 | Open WebUI: Users denied the image-generation permission can still generate images via chat completions |
| CVE-2026-70487 | Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata |
| CVE-2026-70494 | Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder |
| CVE-2026-7050 | Forms Rb <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter |
| CVE-2026-7051 | Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitr... |
| CVE-2026-70547 | Potential unauthorized metadata exposure in JFrog Artifactory |
| CVE-2026-70550 | Potential unauthorized access to private Composer repository metadata in JFrog Artifactory |
| CVE-2026-71307 | Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase)... |
| CVE-2026-71308 | Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates |
| CVE-2026-71316 | Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients |
| CVE-2026-71317 | Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority |
| CVE-2026-71322 | Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False |
| CVE-2026-71415 | Kirby: File upload permissions are not checked during processing of chunk data |
| CVE-2026-7249 | Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purgi... |
| CVE-2026-72661 | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-72664 | Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions |
| CVE-2026-72665 | Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions |
| CVE-2026-72669 | Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering |
| CVE-2026-72671 | Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments |
| CVE-2026-72675 | Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modifica... |
| CVE-2026-72681 | Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure |
| CVE-2026-72810 | SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket |
| CVE-2026-72812 | SiYuan before v3.7.4 Missing Authorization via refreshBacklink |
| CVE-2026-72823 | Grav before 1.0.13 API-key scope cap bypass via DemoController |
| CVE-2026-72824 | Grav before 1.0.13 API Key Scope Bypass via PagesController |
| CVE-2026-72825 | Grav before 1.0.13 API-key scope cap bypass via ReportsController |
| CVE-2026-72843 | EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover |
| CVE-2026-72863 | Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host |
| CVE-2026-72864 | Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers) |
| CVE-2026-72866 | WebSocket Terminal Auth Bypass |
| CVE-2026-72868 | Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection |
| CVE-2026-72876 | Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* |
| CVE-2026-72883 | Dokploy: WebSocket Terminal Missing Service-Level Access Control |
| CVE-2026-72900 | Metabase information exposure |
| CVE-2026-72906 | ERPNext: Unauthorised triggering of automated emails due to missing validation |
| CVE-2026-72910 | ERPNext: Unauthorised modification of master data due to missing validation |
| CVE-2026-72918 | Rocket.Chat: Insecure implementation of websocket notifications |
| CVE-2026-72919 | Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teams |
| CVE-2026-72966 | Windows Remote Access Connection Manager Tampering Vulnerability |
| CVE-2026-73014 | Data Sharing Service Client Elevation of Privilege Vulnerability |
| CVE-2026-73048 | SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID |
| CVE-2026-73140 | cti-transmute Evaluation Report Exports Expose Private Comments and Author Information |
| CVE-2026-73155 | cti-transmute Missing Authorization Allows Reactions to Private Comments |
| CVE-2026-73249 | calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modificati... |
| CVE-2026-73265 | RustFS: Version-specific object reads authorize the non-version action |
| CVE-2026-7328 | Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service |
| CVE-2026-73287 | RustFS: FTPS MKD bypasses IAM CreateBucket authorization |
| CVE-2026-73296 | Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure |
| CVE-2026-73301 | Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings |
| CVE-2026-73305 | Budibase: Privilege escalation via public role assignment API missing app-level authorization |
| CVE-2026-73326 | CamaleonCMS Missing Authorization via Plugin Administration Endpoints |
| CVE-2026-73348 | WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability |
| CVE-2026-73349 | WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability |
| CVE-2026-73352 | WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability |
| CVE-2026-73353 | WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability |
| CVE-2026-73356 | WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability |
| CVE-2026-73363 | WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability |
| CVE-2026-73377 | WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability |
| CVE-2026-73385 | WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability |
| CVE-2026-73394 | WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability |
| CVE-2026-73401 | WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability |
| CVE-2026-73403 | WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability |
| CVE-2026-73404 | WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability |
| CVE-2026-73405 | Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup |
| CVE-2026-73424 | Astro: Unauthenticated path override in the @astrojs/vercel ISR function |
| CVE-2026-73603 | Flowise before 3.1.4 Credential Abuse via Text-to-Speech |
| CVE-2026-73605 | SiYuan before v3.7.4 Path Traversal via getUniqueFilename |
| CVE-2026-73607 | SiYuan before v3.7.4 Information Disclosure via getOutlineStorage |
| CVE-2026-73608 | SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget |
| CVE-2026-73609 | SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels |
| CVE-2026-73653 | Vitest: Browser Mode provider commands bypass the file-access permission gate |
| CVE-2026-73656 | Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state |
| CVE-2026-73658 | Trigger.dev: Cross-tenant object store read and write via URL path traversal |
| CVE-2026-73665 | FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection |
| CVE-2026-7368 | Yarbo Android/iOS Mobile Application and Cloud Infrastructure Missing Authorization |
| CVE-2026-73807 | mySCADA myPRO Manager Missing Authorization |
| CVE-2026-73842 | OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclos... |
| CVE-2026-73843 | OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs |
| CVE-2026-73994 | WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability |
| CVE-2026-74000 | WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability |
| CVE-2026-74002 | WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability |
| CVE-2026-74003 | WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability |
| CVE-2026-74004 | WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability |
| CVE-2026-74006 | WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2026-74010 | WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability |
| CVE-2026-74017 | WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability |
| CVE-2026-74019 | WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability |
| CVE-2026-74020 | WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability |
| CVE-2026-74021 | WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability |
| CVE-2026-7456 | Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Ac... |
| CVE-2026-74869 | stoatchat before 0.15.0 Missing Authorization via Subscribe |
| CVE-2026-74904 | SiYuan before v3.7.4 Missing Authorization via block API |
| CVE-2026-74909 | Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri... |
| CVE-2026-7492 | Missing Authorization in GitLab |
| CVE-2026-74926 | MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint |
| CVE-2026-74927 | MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint |
| CVE-2026-74928 | WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes |
| CVE-2026-74933 | GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite |
| CVE-2026-75017 | Magazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Temp... |
| CVE-2026-75018 | Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Mo... |
| CVE-2026-75027 | Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_da... |
| CVE-2026-75030 | Apache Syncope: Incomplete authorization checks for Group members deprovisioning |
| CVE-2026-75108 | Next Terminal Missing Per-Asset Authorization on Portal Endpoints |
| CVE-2026-75109 | Determined Missing Authorization Check on Generic Task Endpoints |
| CVE-2026-7514 | Missing Authorization in GitLab |
| CVE-2026-75151 | SourceCodester Onlne Examination & Learning Management System cross-site request forgery |
| CVE-2026-7520 | MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover v... |
| CVE-2026-7523 | Alba Board <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'card_id' Par... |
| CVE-2026-7525 | My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' P... |
| CVE-2026-7529 | wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API |
| CVE-2026-7552 | Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Paramete... |
| CVE-2026-7558 | Age Verification & Identity Verification by Token of Trust <= 4.0.2 - Missing Authorization to Unauthenticated Information Ex... |
| CVE-2026-7559 | Affilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification |
| CVE-2026-7563 | Classified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note... |
| CVE-2026-75798 | AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant |
| CVE-2026-75813 | Ebyte NE2-D11 Missing Authorization |
| CVE-2026-75832 | Grav API Plugin before 1.0.14 Authorization Bypass |
| CVE-2026-75835 | Grav API Plugin before 1.0.14 Missing Authorization |
| CVE-2026-75836 | Grav API Plugin before 1.0.14 Missing Authorization |
| CVE-2026-75846 | ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION |
| CVE-2026-75850 | ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers |
| CVE-2026-75853 | ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database |
| CVE-2026-75861 | Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption |
| CVE-2026-75866 | Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types... |
| CVE-2026-75905 | WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unp... |
| CVE-2026-75908 | Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsro... |
| CVE-2026-75930 | FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Pa... |
| CVE-2026-75932 | Jet Admin tenant isolation failure |
| CVE-2026-75982 | LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter |
| CVE-2026-76032 | Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler |
| CVE-2026-76057 | AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_... |
| CVE-2026-76074 | AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_... |
| CVE-2026-7617 | Secufor_OAuth <= 1.0.7 - Missing Authorization to Unauthenticated Account Logout via 'secuforoauth_unregister_action' AJAX Ac... |
| CVE-2026-7620 | Notification for Telegram <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_act... |
| CVE-2026-76209 | phpMyFAQ before v4.1.6 Registration Bypass via API |
| CVE-2026-7621 | SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate |
| CVE-2026-76211 | phpMyFAQ before 4.1.7 Information Disclosure via Admin API |
| CVE-2026-76215 | phpMyFAQ before 4.1.7 Missing Authorization via child resources |
| CVE-2026-76223 | ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION |
| CVE-2026-7624 | SEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations |
| CVE-2026-76251 | Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud |
| CVE-2026-76255 | Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise |
| CVE-2026-76257 | Missing Authorization through REST API Endpoints in Splunk Secure Gateway |
| CVE-2026-76319 | Remote Code Execution (RCE) through Federated Search in Splunk Enterprise |
| CVE-2026-76322 | SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise |
| CVE-2026-76336 | Improper Access Control through the REST API in Splunk Enterprise |
| CVE-2026-76340 | Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise |
| CVE-2026-76348 | Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise |
| CVE-2026-76360 | Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR |
| CVE-2026-76368 | Missing Authorization through Playbooks in Splunk SOAR |
| CVE-2026-76394 | Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit |
| CVE-2026-76398 | Improper Access Control during Experiment History Deletion through the REST API in Splunk AI Toolkit |
| CVE-2026-76633 | WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha |
| CVE-2026-76847 | act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend |
| CVE-2026-76876 | Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API |
| CVE-2026-76962 | Missing Authorization check in SAP S/4HANA (Manage Bank Chains app) |
| CVE-2026-76963 | Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform |
| CVE-2026-77013 | Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch |
| CVE-2026-77087 | Paperclip before 0.3.1 Remote Code Execution via DNS Rebinding |
| CVE-2026-77128 | Broken Access Control in extension "Event management and registration" (sf_event_mgt) |
| CVE-2026-77132 | TYPO3 CMS - Information Disclosure via Backend Localization Wizard |
| CVE-2026-77133 | Broken Access Control in extension "femanager" (femanager) |
| CVE-2026-77140 | Broken Access Control in extension "Telephone Directory" (telephonedirectory) |
| CVE-2026-77141 | Broken Access Control in extension "Club Directory" (clubdirectory) |
| CVE-2026-77142 | Broken Access Control in extension "Industry Directory" (yellowpages2) |
| CVE-2026-77143 | Broken Access Control in extension "Forum" (pforum) |
| CVE-2026-77146 | Broken Access Control in extension "femanager" (femanager) |
| CVE-2026-77191 | All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and author... |
| CVE-2026-7726 | Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX A... |
| CVE-2026-77391 | SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery |
| CVE-2026-77507 | Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users |
| CVE-2026-7753 | Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure |
| CVE-2026-7761 | Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure |
| CVE-2026-77694 | Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token |
| CVE-2026-77701 | WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders |
| CVE-2026-77702 | Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token |
| CVE-2026-77767 | Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authenticat... |
| CVE-2026-77770 | miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator |
| CVE-2026-77787 | Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk |
| CVE-2026-77966 | Ebyte NA111-M Missing Authorization |
| CVE-2026-7802 | Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id'... |
| CVE-2026-78069 | Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-... |
| CVE-2026-78137 | StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart |
| CVE-2026-78204 | Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints |
| CVE-2026-78258 | WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability |
| CVE-2026-78266 | WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability |
| CVE-2026-78272 | WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability |
| CVE-2026-78291 | WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability |
| CVE-2026-78328 | A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a l... |
| CVE-2026-78361 | zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion |
| CVE-2026-78365 | IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification |
| CVE-2026-78370 | RansomLook Unauthenticated Database Export Exposes Private Data |
| CVE-2026-78372 | RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data |
| CVE-2026-78380 | Private Group and Market Posts Disclosed Through Public Notification Channels in RansomLook |
| CVE-2026-78387 | RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification |
| CVE-2026-78528 | WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability |
| CVE-2026-78536 | WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability |
| CVE-2026-7859 | Motors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media |
| CVE-2026-78595 | Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure |
| CVE-2026-78596 | Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations |
| CVE-2026-78597 | Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation |
| CVE-2026-78601 | Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure |
| CVE-2026-78603 | Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata |
| CVE-2026-78607 | Missing Authorization in Elasticsearch Leading to Information Disclosure |
| CVE-2026-78608 | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-7879 | Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password() |
| CVE-2026-79632 | WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission |
| CVE-2026-79652 | Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired |
| CVE-2026-79665 | Ech0 before 4.5.1 Authorization Bypass via Session Tokens |
| CVE-2026-79666 | Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints |
| CVE-2026-79669 | Ech0 before 4.4.3 Missing Authorization on System Logs |
| CVE-2026-79672 | Ech0 before 4.4.3 Authentication Bypass via Comment Panel |
| CVE-2026-79744 | MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration |
| CVE-2026-79745 | MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resourc... |
| CVE-2026-79748 | MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args) |
| CVE-2026-79993 | Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container... |
| CVE-2026-80191 | GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests |
| CVE-2026-80193 | Kimai before 2.62.0 Authorization Bypass via QuickEntry |
| CVE-2026-8030 | Missing Authorization in GitLab |
| CVE-2026-80346 | StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views |
| CVE-2026-80348 | TarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete Endpoints |
| CVE-2026-80433 | WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability |
| CVE-2026-8077 | Weak credentials vulnerability in the CashDro 3 web administration panel |
| CVE-2026-8096 | Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_a... |
| CVE-2026-81027 | one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning |
| CVE-2026-81035 | Midday Missing Owner Check on Team Deletion |
| CVE-2026-81164 | Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114 |
| CVE-2026-81166 | Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109 |
| CVE-2026-81211 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution gu... |
| CVE-2026-81269 | Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108 |
| CVE-2026-81272 | WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability |
| CVE-2026-81274 | WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability |
| CVE-2026-81276 | WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability |
| CVE-2026-81278 | WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability |
| CVE-2026-81279 | WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability |
| CVE-2026-81284 | WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability |
| CVE-2026-81296 | WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability |
| CVE-2026-81335 | Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources |
| CVE-2026-81346 | Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion |
| CVE-2026-81427 | WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change |
| CVE-2026-8144 | Missing Authorization in GitLab |
| CVE-2026-81648 | CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router |
| CVE-2026-81758 | WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability |
| CVE-2026-81759 | WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability |
| CVE-2026-81761 | WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability |
| CVE-2026-81762 | WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability |
| CVE-2026-81767 | WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability |
| CVE-2026-81781 | WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2026-81785 | WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability |
| CVE-2026-81786 | WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-81788 | WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability |
| CVE-2026-81790 | WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability |
| CVE-2026-81793 | WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability |
| CVE-2026-81794 | WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability |
| CVE-2026-81799 | WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability |
| CVE-2026-81801 | WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability |
| CVE-2026-81819 | Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments |
| CVE-2026-81823 | AVEVA Pipeline Integrity Monitor Missing Authorization |
| CVE-2026-81866 | Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration |
| CVE-2026-81892 | EasyAdmin custom-action dispatcher bypasses access_control on other routes |
| CVE-2026-81901 | Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint |
| CVE-2026-81904 | Concrete CMS before 9.5.3 is vulnerable to Missing Authorization in Stack/Container Sub-Block Asset Registration |
| CVE-2026-81908 | Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate A... |
| CVE-2026-81909 | Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authentica... |
| CVE-2026-81915 | In Concrete CMS below 9.5.3, Page Type update omits object-level authorization |
| CVE-2026-81916 | Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unautho... |
| CVE-2026-81921 | In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status |
| CVE-2026-81922 | "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reo... |
| CVE-2026-81923 | Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor |
| CVE-2026-8194 | osTicket Dispatcher class.dispatcher.php cross-site request forgery |
| CVE-2026-82184 | WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update |
| CVE-2026-82185 | WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset |
| CVE-2026-82223 | WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability |
| CVE-2026-82239 | Budibase before 3.41.3 Authorization Bypass via datasources/query |
| CVE-2026-82240 | Budibase before 3.41.3 Privilege Escalation via User Update API |
| CVE-2026-82242 | Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization |
| CVE-2026-82245 | Budibase before 3.41.3 Missing Authorization License Management |
| CVE-2026-82267 | Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check |
| CVE-2026-82273 | Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset |
| CVE-2026-82279 | HyperDX Team Management Operations Missing Role-Based Access Control |
| CVE-2026-8236 | Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialo... |
| CVE-2026-8237 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint |
| CVE-2026-8238 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message_page' allowing unauthenticated rea... |
| CVE-2026-8239 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating' |
| CVE-2026-82394 | Sulu: Fix authorization bypass when creating preview links |
| CVE-2026-82433 | Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI |
| CVE-2026-82437 | Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer |
| CVE-2026-82475 | iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check |
| CVE-2026-82519 | Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler |
| CVE-2026-82544 | wger-project wger Password Reset gym.py reset_user_password cross-site request forgery |
| CVE-2026-82561 | Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods |
| CVE-2026-82567 | mySCADA myPRO Manager Missing Authorization |
| CVE-2026-82633 | Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint |
| CVE-2026-82660 | Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess |
| CVE-2026-82684 | Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization |
| CVE-2026-82746 | Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records |
| CVE-2026-8279 | Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion |
| CVE-2026-82848 | Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure |
| CVE-2026-82871 | ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes |
| CVE-2026-82878 | DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints |
| CVE-2026-82882 | Devtron through 2.2.0 Missing Authorization via webhook API token endpoint |
| CVE-2026-82923 | AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes |
| CVE-2026-82964 | Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys |
| CVE-2026-8304 | Information Disclosure in TUBITAK BILGEM's Pardus About |
| CVE-2026-83628 | Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via '... |
| CVE-2026-8377 | Improper Authorization in Armiya Technologies' Access Control System |
| CVE-2026-8381 | Broken Access Control in TeamViewer DEX Platform (On Premises) |
| CVE-2026-8382 | Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_p... |
| CVE-2026-8383 | LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API |
| CVE-2026-83941 | Entra ID Elevation of Privilege Vulnerability |
| CVE-2026-83942 | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2026-84066 | Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload |
| CVE-2026-8407 | Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no addition... |
| CVE-2026-84204 | GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval |
| CVE-2026-84215 | WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability |
| CVE-2026-84217 | WordPress Classified Listing plugin <= 6.1.1 - Broken Access Control vulnerability |
| CVE-2026-84238 | WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability |
| CVE-2026-84470 | Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at... |
| CVE-2026-84715 | FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update |
| CVE-2026-8472 | Missing Authorization in GitLab |
| CVE-2026-84754 | WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability |
| CVE-2026-84755 | WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability |
| CVE-2026-84757 | WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability |
| CVE-2026-84758 | WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability |
| CVE-2026-84760 | WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.9 - Broken Access Control vulnerability |
| CVE-2026-84779 | WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability |
| CVE-2026-84792 | Craft CMS before 5.10.11 Broken Access Control via element-indexes |
| CVE-2026-84794 | Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset |
| CVE-2026-84797 | Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate |
| CVE-2026-84798 | Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite |
| CVE-2026-84800 | Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file |
| CVE-2026-84801 | Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers |
| CVE-2026-84802 | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController |
| CVE-2026-84805 | Kimai 2.61.0 before 2.63.0 Authentication Bypass via API |
| CVE-2026-84821 | WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability |
| CVE-2026-84835 | WordPress Rentsyst plugin <= 2.1.2 - Broken Access Control vulnerability |
| CVE-2026-84847 | WordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability |
| CVE-2026-84869 | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions |
| CVE-2026-84901 | Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization |
| CVE-2026-84904 | King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer |
| CVE-2026-84905 | Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation |
| CVE-2026-84907 | Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint |
| CVE-2026-84908 | WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment'... |
| CVE-2026-84927 | EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification |
| CVE-2026-8495 | Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037 |
| CVE-2026-84989 | ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags |
| CVE-2026-8502 | LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters |
| CVE-2026-85038 | B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection |
| CVE-2026-85132 | WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan |
| CVE-2026-85133 | WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions |
| CVE-2026-85210 | Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET |
| CVE-2026-85212 | CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check |
| CVE-2026-85213 | Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints |
| CVE-2026-85226 | MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations |
| CVE-2026-85304 | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Broken Access Control vulnera... |
| CVE-2026-85306 | WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability |
| CVE-2026-85309 | WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2026-85311 | WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability |
| CVE-2026-85390 | Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes |
| CVE-2026-85395 | UnoPim before 2.1.3 Missing Authorization on Integration Management Routes |
| CVE-2026-85400 | TYPO3 CMS - Missing Authorization in lowlevel commands |
| CVE-2026-85433 | MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration |
| CVE-2026-85512 | SourceCodester Class and Exam Timetabling System session.php authorization |
| CVE-2026-85533 | MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter |
| CVE-2026-85578 | SiYuan through 3.8.1 Authorization Bypass via getFile |
| CVE-2026-85589 | phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API |
| CVE-2026-85605 | Slink before 1.12.3 Missing Authorization on Image Comment Endpoints |
| CVE-2026-85651 | Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay |
| CVE-2026-85669 | potpie through 2.0.0 Missing Ownership Check via code-changes sync |
| CVE-2026-8593 | Fix Business Intelligence API Pack permission |
| CVE-2026-86077 | n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket |
| CVE-2026-86085 | n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints |
| CVE-2026-86089 | Apache NiFi: Missing Process Group Authorization for Connector Migration |
| CVE-2026-86090 | ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers |
| CVE-2026-86091 | ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler |
| CVE-2026-8610 | TypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification v... |
| CVE-2026-86114 | Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints |
| CVE-2026-86116 | Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API |
| CVE-2026-86118 | gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint |
| CVE-2026-8614 | Assistio <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_... |
| CVE-2026-8615 | ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token... |
| CVE-2026-8616 | Fense Proxy & VPN Blocker <= 3.0.1 - Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt... |
| CVE-2026-8617 | SearchPlus <= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token &... |
| CVE-2026-86177 | Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks |
| CVE-2026-86178 | Pixelfed through 0.12.9 Unauthorized Story Access via API |
| CVE-2026-86182 | diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery |
| CVE-2026-86194 | Grav Form Plugin before 9.1.22 Cross-Page Form Execution |
| CVE-2026-86254 | wger Incomplete Authorization Fix Cross-Tenant Account Deletion |
| CVE-2026-86271 | FluentCMS PermissionManager.cs GetAccessible authorization |
| CVE-2026-86274 | projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization |
| CVE-2026-86281 | SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery |
| CVE-2026-86283 | MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data |
| CVE-2026-86307 | light0011 cms cross-site request forgery |
| CVE-2026-86332 | Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user |
| CVE-2026-86342 | MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information |
| CVE-2026-86347 | MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion |
| CVE-2026-86408 | MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events |
| CVE-2026-86416 | ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods |
| CVE-2026-86417 | MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users |
| CVE-2026-86418 | MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users |
| CVE-2026-86436 | Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints |
| CVE-2026-86438 | Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action |
| CVE-2026-86441 | MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data |
| CVE-2026-86451 | MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects |
| CVE-2026-86665 | aircheng-org iWebShop-5 update.php index authorization |
| CVE-2026-86731 | Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController |
| CVE-2026-86737 | snipe-it before 8.7.0 Missing Authorization via barcode endpoint |
| CVE-2026-86757 | Snipe-IT before 8.7.0 Information Disclosure via Custom Fields |
| CVE-2026-86759 | Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer |
| CVE-2026-86762 | Snipe-IT before 8.7.0 Authentication Bypass via API Middleware |
| CVE-2026-86764 | Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components |
| CVE-2026-86765 | Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint |
| CVE-2026-86777 | AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes |
| CVE-2026-86779 | Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart |
| CVE-2026-8678 | MyParcel <= 4.25.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Data Disclosure and Modifi... |
| CVE-2026-8681 | Essential Chat Support <= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter |
| CVE-2026-86815 | BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes |
| CVE-2026-86819 | Waves Central local privilege escalation via Improper XPC Client Authentication in macOS |
| CVE-2026-8682 | 3D Viewer <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings... |
| CVE-2026-8684 | MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_upd... |
| CVE-2026-8688 | Advance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_sa... |
| CVE-2026-8689 | Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitra... |
| CVE-2026-8690 | RentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cd... |
| CVE-2026-8692 | Vedrixa Forms <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_... |
| CVE-2026-86993 | n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check |
| CVE-2026-86994 | n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter |
| CVE-2026-86996 | n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy |
| CVE-2026-87026 | Tanium addressed an improper access controls vulnerability in Threat Response. |
| CVE-2026-87028 | Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Field... |
| CVE-2026-87031 | Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account cre... |
| CVE-2026-87036 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87037 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87048 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87072 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87073 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-8761 | Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation |
| CVE-2026-87792 | Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme |
| CVE-2026-87797 | Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note |
| CVE-2026-87831 | Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field |
| CVE-2026-87860 | Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF |
| CVE-2026-87919 | Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode |
| CVE-2026-87994 | Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint |
| CVE-2026-87997 | Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions |
| CVE-2026-8821 | Playbooks run owner channel membership permission bypass |
| CVE-2026-88269 | GV-LPC2011/LPC2211 - SSVR Guest Configuration and Credential Disclosure |
| CVE-2026-88270 | GV-LPC2011/LPC2211 - SSVR Guest Firmware-Mode Pre-Validation Service Teardown Denial of Service |
| CVE-2026-88271 | GV-LPC2011/LPC2211 - SSVR Guest Configuration Overwrite and Administrative Credential Takeover |
| CVE-2026-8840 | Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via... |
| CVE-2026-8848 | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorizat... |
| CVE-2026-88802 | MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion |
| CVE-2026-88898 | AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint |
| CVE-2026-88915 | MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization |
| CVE-2026-88959 | Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints |
| CVE-2026-89007 | Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization |
| CVE-2026-89023 | ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API |
| CVE-2026-89030 | Blog2Social WordPress Plugin < 9.1.0 User Email Disclosure via b2s_search_user |
| CVE-2026-89054 | OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes |
| CVE-2026-89138 | Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Par... |
| CVE-2026-89265 | MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint |
| CVE-2026-8934 | Cross-Project Information Leakage in Google App Engine UI |
| CVE-2026-89413 | Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id... |
| CVE-2026-8976 | RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Pur... |
| CVE-2026-8996 | Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information... |
| CVE-2026-9008 | Page-list <= 6.2 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attri... |
| CVE-2026-9011 | Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action |
| CVE-2026-9013 | Bogo <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API |
| CVE-2026-9014 | WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action |
| CVE-2026-9015 | Equalize Digital Accessibility Checker <= 1.42.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibili... |
| CVE-2026-9017 | NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Act... |
| CVE-2026-9021 | Easy Invoice <= 2.1.19 - Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote /... |
| CVE-2026-9028 | CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'o... |
| CVE-2026-90448 | A deployment mode intended to expose only read access to stored data proxies a set of application programming interface route... |
| CVE-2026-90454 | A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of wri... |
| CVE-2026-9050 | Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deac... |
| CVE-2026-90508 | Chengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorization |
| CVE-2026-90533 | Flowise before 3.1.4 Broken Access Control via organizationuser |
| CVE-2026-90535 | Flowise before 3.1.4 Denial of Service via text-to-speech/abort |
| CVE-2026-90537 | WWBN AVideo Scheduler sendEmail Missing Authorization via Token |
| CVE-2026-90540 | WWBN AVideo Missing Authorization via playListAddVideo.json.php |
| CVE-2026-90544 | WWBN AVideo Missing Authorization via videoAddViewCount.json.php |
| CVE-2026-90545 | WWBN AVideo Missing Authorization via commentAddNew.json.php |
| CVE-2026-90546 | WWBN AVideo Missing Authorization via like.json.php |
| CVE-2026-90547 | WWBN AVideo Missing Authorization via getBookmarks.json.php |
| CVE-2026-90551 | WWBN AVideo Missing Authorization via video_from_program API |
| CVE-2026-90594 | wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization |
| CVE-2026-90595 | wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization |
| CVE-2026-90599 | Rizwan17 inventory-management-system process.php cross-site request forgery |
| CVE-2026-90768 | CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check |
| CVE-2026-90806 | DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization |
| CVE-2026-90820 | a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization |
| CVE-2026-90895 | MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection |
| CVE-2026-90933 | laradashboard through 1.2.2 Missing Authorization via License API |
| CVE-2026-90939 | novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint |
| CVE-2026-90941 | novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint |
| CVE-2026-91009 | Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment |
| CVE-2026-91010 | Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion |
| CVE-2026-91015 | Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired |
| CVE-2026-9132 | Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Cop... |
| CVE-2026-91707 | Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter vi... |
| CVE-2026-9172 | Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint |
| CVE-2026-9175 | Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter |
| CVE-2026-91774 | Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint |
| CVE-2026-9178 | WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint |
| CVE-2026-91825 | MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit |
| CVE-2026-9184 | 24liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action |
| CVE-2026-91846 | MISP Collection Element Add Missing Authorization on Referenced Object UUID |
| CVE-2026-9187 | Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter |
| CVE-2026-91924 | pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint |
| CVE-2026-91929 | Flowise before 3.1.4 Cross-Tenant Authorization Bypass |
| CVE-2026-9199 | Equalize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to Authenticated (Author+) Arbitrary Accessibility I... |
| CVE-2026-91994 | Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests |
| CVE-2026-9224 | Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user... |
| CVE-2026-92299 | @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture |
| CVE-2026-9230 | Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification an... |
| CVE-2026-9233 | Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm... |
| CVE-2026-9234 | JTL-Connector for WooCommerce <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multi... |
| CVE-2026-9235 | DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping La... |
| CVE-2026-9237 | Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary J... |
| CVE-2026-92383 | PbootCMS User Management UserController.php mod cross-site request forgery |
| CVE-2026-9240 | Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) A... |
| CVE-2026-92402 | ChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorization |
| CVE-2026-92455 | yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints |
| CVE-2026-92456 | yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints |
| CVE-2026-92457 | yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice |
| CVE-2026-92458 | yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale |
| CVE-2026-92459 | yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint |
| CVE-2026-9246 | Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user... |
| CVE-2026-92460 | yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing |
| CVE-2026-92461 | yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint |
| CVE-2026-92462 | yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep |
| CVE-2026-92463 | yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing |
| CVE-2026-92466 | microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking |
| CVE-2026-9251 | Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated u... |
| CVE-2026-9255 | Tool Execution Without Authorization via Piped Stdin in Kiro CLI |
| CVE-2026-92570 | reNgine through 2.2.0 Unauthorized Configuration File Read |
| CVE-2026-92585 | AVideo through 29.0 Missing Authorization Check via API Like Endpoint |
| CVE-2026-92586 | AVideo through 29.0 Missing Authorization via comment API endpoint |
| CVE-2026-92589 | Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder |
| CVE-2026-92600 | Guns through 8.3.5 Information Disclosure via Missing Permission Check |
| CVE-2026-92601 | Guns through 8.3.5 Improper Access Control via SysNoticeController |
| CVE-2026-92729 | SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints |
| CVE-2026-92750 | Harness through 3.3.0 Missing Access Control via infraproviders endpoint |
| CVE-2026-92753 | PatrowlManager through 1.8.4 Authorization Bypass via Events API |
| CVE-2026-92754 | PatrowlManager through 1.8.4 Improper Access Control via users API |
| CVE-2026-92761 | WebVirtCloud Missing Authorization on Instance Control Actions |
| CVE-2026-92762 | Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup |
| CVE-2026-92763 | Rundeck through 6.2.1 Authorization Bypass via Project Import |
| CVE-2026-92772 | Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX |
| CVE-2026-92780 | KnowStreaming through 3.4.1 Missing Authorization on the REST API |
| CVE-2026-92783 | Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion |
| CVE-2026-92794 | OpenSign through 2.41.3 Information Disclosure via getDocument |
| CVE-2026-92802 | kan through 0.6.0 Authorization Bypass via GitHub Project Import |
| CVE-2026-92803 | LibreTranslate through 1.9.6 Missing Access Check on the download_file Route |
| CVE-2026-9284 | WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure |
| CVE-2026-92992 | Dromara mayfly-go AI Assistant ai.go authorization |
| CVE-2026-9303 | calcom cal.diy cross-site request forgery |
| CVE-2026-9331 | EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Autho... |
| CVE-2026-93455 | django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account |
| CVE-2026-9350 | NousResearch hermes-agent Batch Runner approval.py check_all_command_guards authorization |
| CVE-2026-9486 | SourceCodester Student Grades Management System cross-site request forgery |
| CVE-2026-9582 | SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery |
| CVE-2026-9603 | SourceCodester eDoc Doctor Appointment System delete-session.php authorization |
| CVE-2026-9616 | Generate Security.txt <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_secur... |
| CVE-2026-9619 | Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJ... |
| CVE-2026-9676 | f4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification |
| CVE-2026-9771 | Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation |
| CVE-2026-9820 | Mattermost schemes teams endpoint exposes private team invite IDs |
| CVE-2026-9824 | Remote cluster metadata enumeration via /share-channel autocomplete |
| CVE-2026-9857 | Invoice123 <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s12... |
| CVE-2026-65916 | CyberPanel Missing Authorization in cancelBackupCreation Handler |
| CVE-2026-65922 | Potential unauthorized modification of Artifactory internal metadata |
| CVE-2026-65926 | Private Release Bundle versions may be disclosed under specific configurations |
| CVE-2026-65931 | LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint |
| CVE-2026-65938 | WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API. |
| CVE-2026-65959 | Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data |
| CVE-2026-66012 | SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP |
| CVE-2026-66027 | Suna < 0.9.102 Broken Access Control via Message Queue API |
| CVE-2026-66058 | Frappe: Unrestricted access to a Document Follow API |
| CVE-2026-66060 | Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers |
| CVE-2026-66061 | Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution |
| CVE-2026-66109 | A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited,... |
| CVE-2026-6627 | WPFormify <= 1.1.1 - Missing Authorization |
| CVE-2026-66311 | Microsoft Edge (Chromium-based) Tampering Vulnerability |
| CVE-2026-66326 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-66375 | Low-privilege users may remove protected Artifactory metadata |
| CVE-2026-66377 | Anonymous users may access restricted Artifactory repository information |
| CVE-2026-66378 | Authenticated users may access private NuGet metadata |
| CVE-2026-66379 | Authenticated users may view private Puppet module metadata |
| CVE-2026-66380 | Authenticated users may access private OCI referrer metadata |
| CVE-2026-6639 | AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure |
| CVE-2026-66431 | WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2026-66441 | WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability |
| CVE-2026-66442 | WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability |
| CVE-2026-66452 | WordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability |
| CVE-2026-66454 | WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability |
| CVE-2026-66455 | WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability |
| CVE-2026-66459 | WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability |
| CVE-2026-66461 | WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability |
| CVE-2026-66464 | WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability |
| CVE-2026-66466 | WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <=... |
| CVE-2026-66469 | WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2026-66470 | WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability |
| CVE-2026-66473 | WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability |
| CVE-2026-66477 | WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability |
| CVE-2026-66589 | WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability |
| CVE-2026-66595 | WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability |
| CVE-2026-6663 | GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent |
| CVE-2026-66647 | WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability |
| CVE-2026-66651 | WordPress MultiVendorX plugin <= 5.0.14 - Broken Access Control vulnerability |
| CVE-2026-66660 | WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability |
| CVE-2026-6667 | PgBouncer missing authorization check in KILL_CLIENT admin command |
| CVE-2026-66676 | WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability |
| CVE-2026-66678 | WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability |
| CVE-2026-66689 | WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability |
| CVE-2026-66693 | WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability |
| CVE-2026-66699 | WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability |
| CVE-2026-66701 | WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability |
| CVE-2026-67262 | Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this v... |
| CVE-2026-67344 | ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE |
| CVE-2026-67398 | Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from... |
| CVE-2026-67440 | FUXA: Unauthenticated Socket.IO read events |
| CVE-2026-67443 | FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution) |
| CVE-2026-67527 | OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks" |
| CVE-2026-67529 | OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked w... |
| CVE-2026-67616 | Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint |
| CVE-2026-67621 | Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints |
| CVE-2026-6792 | Improper Authorization in Universal Sotware's FlexCity |
| CVE-2026-6798 | 2Download Connector for 2DL Hosted Checkout <= 0.1.5 - Missing Authorization to Unauthenticated Sensitive Customer Subscripti... |
| CVE-2026-6803 | AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJA... |
| CVE-2026-6804 | AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'pub... |
| CVE-2026-6821 | Missing Authorization in GitLab |
| CVE-2026-0679 | Fortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api'... |
| CVE-2026-0687 | Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management |
| CVE-2026-0692 | BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulat... |
| CVE-2026-0718 | Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta M... |
| CVE-2026-0727 | Accordion and Accordion Slider <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modificat... |
| CVE-2026-66708 | WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability |
| CVE-2026-66712 | WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability |
| CVE-2026-66721 | Apache CloudStack: Authorization issue with listHostTags for domain admins |
| CVE-2026-66723 | Missing authentication requirement in Remote Instances proxy API in MWDB Core |
| CVE-2026-66724 | Permission Bypass Via Undocumented HTTP Methods In MWDB Core |
| CVE-2026-66750 | Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route |
| CVE-2026-66751 | Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room |
| CVE-2026-66772 | Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools) |
| CVE-2026-66887 | Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups |
| CVE-2026-6689 | *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains... |
| CVE-2026-6703 | Responsive Blocks <= 2.2.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via AJAX Actions |
| CVE-2026-6706 | Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read d... |
| CVE-2026-6708 | HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom De... |
| CVE-2026-6709 | Coinbase Commerce for Contact Form 7 <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) API Key Modification via... |
| CVE-2026-6834 | aEnrich｜a+HRD - Missing Authorization |
| CVE-2026-68484 | Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not... |
| CVE-2026-68529 | Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a... |
| CVE-2026-68530 | Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Dele... |
| CVE-2026-68533 | Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Messag... |
| CVE-2026-68535 | Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path lettin... |
| CVE-2026-68585 | SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo |
| CVE-2026-68586 | SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc |
| CVE-2026-68587 | SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction |
| CVE-2026-68753 | Anonymous users may access restricted Artifactory content under specific configurations |
| CVE-2026-68754 | Publishers without delete permission can overwrite docker layer information |
| CVE-2026-68758 | Authenticated users may access restricted Artifactory support information |
| CVE-2026-6883 | Missing Authorization in GitLab |
| CVE-2026-68929 | FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization |
| CVE-2026-69252 | Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces w... |
| CVE-2026-6937 | Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointme... |
| CVE-2026-69377 | Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability |
| CVE-2026-69380 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2026-69403 | Windows SMB Server Information Disclosure Vulnerability |
| CVE-2026-69453 | Microsoft Windows Search Component Tampering Vulnerability |
| CVE-2026-69465 | Microsoft Office SharePoint Remote Code Execution Vulnerability |
| CVE-2026-69553 | Windows Hyper-V Elevation of Privilege Vulnerability |
| CVE-2026-6963 | WP Mail Gateway <= 1.8 - Missing Authorization to Authenticated (Subscriber+) SMTP Configuration Modification via 'wmg_save_p... |
| CVE-2026-6964 | Video Conferencing with Zoom <= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth'... |
| CVE-2026-69641 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2026-70340 | Azure CycleCloud Elevation of Privilege Vulnerability |
| CVE-2026-70617 | Spacebar Server Missing Authorization via Group DM Recipient Endpoint |
| CVE-2026-70618 | Spacebar Server Missing Authorization via member-ids Endpoint |
| CVE-2026-70619 | Odysseus Missing Admin Authorization via Embedding Endpoint Routes |
| CVE-2026-70636 | Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint |
| CVE-2026-7105 | Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_edit... |
| CVE-2026-7108 | code-projects Invoice System in Laravel cross-site request forgery |
| CVE-2026-71252 | toner-management - Unauthenticated State-Changing Admin Actions |
| CVE-2026-71264 | WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State |
| CVE-2026-71504 | Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset |
| CVE-2026-71508 | Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint |
| CVE-2026-71509 | Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint |
| CVE-2026-71933 | DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions |
| CVE-2026-71959 | Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect |
| CVE-2026-71962 | Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download |
| CVE-2026-72692 | OpenSignLabs opensignserver - Missing Authorization |
| CVE-2026-72709 | SPIP < 4.4.18 Missing Authorization via ecrire/action/ |
| CVE-2026-72722 | Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs |
| CVE-2026-72723 | Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags |
| CVE-2026-72732 | Discourse: Templates endpoint exposes hidden tag names |
| CVE-2026-72737 | Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups |
| CVE-2026-72759 | cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion |
| CVE-2026-72789 | SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks |
| CVE-2026-72790 | SiYuan before v3.7.4 Information Disclosure via getNotebookInfo |
| CVE-2026-72791 | SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews |
| CVE-2026-72795 | SiYuan before v3.7.4 Information Disclosure via Embed Block |
| CVE-2026-72796 | SiYuan before v3.7.4 Access Control Bypass via Static Routes |
| CVE-2026-72797 | SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus |
| CVE-2026-72798 | SiYuan before v3.7.4 Information Disclosure via renderAttributeView |
| CVE-2026-72799 | SiYuan before v3.7.4 Information Disclosure via Path Resolution |
| CVE-2026-72800 | SiYuan before v3.7.4 Information Disclosure via Unfiltered API |
| CVE-2026-72803 | SiYuan before v3.7.4 Information Disclosure via getBlockAttrs |
| CVE-2026-72805 | SiYuan before v3.7.4 Information Disclosure via Block Endpoints |
| CVE-2026-72806 | SiYuan before v3.7.4 Authentication Bypass via Attribute View |
| CVE-2026-72808 | SiYuan before v3.7.4 Information Disclosure via getFileAnnotation |
| CVE-2023-23895 | WordPress WP Time Slots Booking Form plugin <= 1.1.82 - Broken Access Control vulnerability |
| CVE-2023-23896 | WordPress URL Shortener by MyThemeShop Plugin <= 1.0.17 is vulnerable to Broken Access Control |
Exploits & Shellcodes
| Идентификатор | Тип | Описание | Дата публикации |
|---|---|---|---|
| EDB-52596 | Exploit | Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution | 29.05.2026 |
| EDB-52527 | Exploit | SUSE Manager 4.3.15 - Code Execution | 30.04.2026 |
| EDB-52523 | Exploit | phpMyFAQ 4.0.16 - Improper Authorization | 29.04.2026 |
| EDB-52511 | Exploit | WordPress Plugin 5.2.0 - Broken Access Control | 22.04.2026 |
| EDB-52259 | Exploit | Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation | 18.04.2025 |
| EDB-52256 | Exploit | Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation | 17.04.2025 |
| EDB-51658 | Exploit | Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access | 04.08.2023 |
| EDB-51241 | Exploit | Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS) | 05.04.2023 |
| EDB-51146 | Exploit | CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token | 30.03.2023 |
| EDB-50993 | Exploit | WordPress Plugin Duplicator 1.4.7 - Information Disclosure | 01.08.2022 |
CISA KEV - известные эксплуатируемые уязвимости
Записи каталога CISA, для которых известны факты активной эксплуатации
| Идентификатор | Дата добавления | Описание | Ransomware |
|---|---|---|---|
| CVE-2021-30657 | 03.11.2021 | Apple macOS contains an unspecified logic issue in System Preferences that may allow a malicious application to bypass Gatekeeper checks. | Нет |
| CVE-2021-30713 | 03.11.2021 | Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences. | Нет |
| CVE-2021-3493 | 20.10.2022 | The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation... | Нет |
| CVE-2021-37976 | 03.11.2021 | Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from pro... | Нет |
| CVE-2022-0492 | 02.06.2026 | Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature. | Нет |
| CVE-2022-0543 | 28.03.2022 | Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. | Нет |
| CVE-2023-52163 | 22.12.2025 | Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi. | Нет |
| CVE-2024-57726 | 24.04.2026 | SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to e... | Да |
| CVE-2025-20362 | 25.09.2025 | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnera... | Нет |
| CVE-2025-40602 | 17.12.2025 | SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices. | Нет |
| CVE-2025-6205 | 28.10.2025 | Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application. | Нет |
| CVE-2026-84869 | 11.09.2026 | ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through a... | Нет |
НКЦКИ уязвимости
Бюллетени НКЦКИ - уязвимости ПО
| Идентификатор | Дата бюллетеня | Описание |
|---|---|---|
| VULN:20230724-11 | 24.07.2023 | Обход безопасности в NETGEAR NMS300 |
| VULN:20231122-29 | 22.11.2023 | Выполнение произвольного кода в NEC Corporation EXPRESSCLUSTER X and EXPRESSCLUSTER SingleServerSafe |
| VULN:20240126-19 | 26.01.2024 | Выполнение произвольного кода в GoAnywhere MFT |
| VULN:20240320-6 | 20.03.2024 | Получение конфиденциальной информации в Chrome OS |
| VULN:20240403-1 | 03.04.2024 | Выполнение произвольного кода в Anyscale Ray |
| VULN:20240419-26 | 19.04.2024 | Обход безопасности в Oracle Linux |
| VULN:20240517-65 | 17.05.2024 | Повышение привилегий в macOS |
| VULN:20240605-22 | 05.06.2024 | Перезапись произвольных файлов в Unifier |
| VULN:20241202-86 | 02.12.2024 | Выполнение произвольного кода в NVIDIA Base Command Manager |
| VULN:20241213-111 | 13.12.2024 | Получение конфиденциальной информации в Schneider Electric EcoStruxure IT Gateway |
| VULN:20241227-40 | 27.12.2024 | Выполнение произвольного кода в Dell Hybrid Client |
| VULN:20250110-42 | 10.01.2025 | Перезапись произвольных файлов в Junos Space |
| VULN:20250430-17 | 30.04.2025 | Получение конфиденциальной информации в Flynax Bridge plugin for WordPress |
| VULN:20250625-26 | 25.06.2025 | Чтение локальных файлов в Adobe Commerce and Magento Open Source |
| VULN:20251031-5 | 31.10.2025 | Получение конфиденциальной информации в Zyxel firewalls |
| VULN:20251031-65 | 31.10.2025 | Получение конфиденциальной информации в Junos Space Security Director |
| VULN:20251124-65 | 24.11.2025 | Обход безопасности в Junos Space Security Director |
| VULN:20260223-9 | 23.02.2026 | Повышение привилегий в Apple macOS Tahoe |
| VULN:20260506-2 | 06.05.2026 | Выполнение произвольного кода в Cisco Evolved Programmable Network Manager |
| VULN:20260526-65 | 26.05.2026 | Выполнение произвольного кода в FortiSandbox |
| VULN:20260526-92 | 26.05.2026 | Повышение привилегий в Microsoft Windows Admin Center |
| VULN:20260603-8 | 03.06.2026 | Получение конфиденциальной информации в Date iCal module for Drupal |
| VULN:20260616-14 | 16.06.2026 | Получение конфиденциальной информации в Ubuntu |
| VULN:20260616-64 | 16.06.2026 | Выполнение произвольного кода в MLflow |
| VULN:20260723-102 | 23.07.2026 | Повышение привилегий в Dell Automation Platform |
| VULN:20260723-43 | 23.07.2026 | Повышение привилегий в Microsoft Exchange Online |
| VULN:20260827-55 | 27.08.2026 | Повышение привилегий в Azure SRE Agent |
| VULN:20260827-62 | 27.08.2026 | Повышение привилегий в Microsoft Teams |
| VULN:20260917-149 | 17.09.2026 | Повышение привилегий в Microsoft Entra ID |
| VULN:20260917-170 | 17.09.2026 | Повышение привилегий в SolarWinds Serv-U |
| VULN:20260917-197 | 17.09.2026 | Повышение привилегий в SolarWinds Serv-U |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.