Export limit exceeded: 417223 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11412 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11412 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-115959 | 2026-10-26 | 5.3 Medium | ||
| Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5. | ||||
| CVE-2026-115595 | 2026-10-26 | 5.3 Medium | ||
| Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7. | ||||
| CVE-2026-116492 | 1 Frappe | 1 Frappe Crm | 2026-10-26 | 6.5 Medium |
| Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data. | ||||
| CVE-2026-94295 | 2026-10-26 | 5.3 Medium | ||
| The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made. | ||||
| CVE-2026-115958 | 2026-10-26 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion Board: from n/a through 2.6.0. | ||||
| CVE-2026-115949 | 2026-10-26 | 6.5 Medium | ||
| Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1. | ||||
| CVE-2026-115614 | 2026-10-26 | 5.3 Medium | ||
| Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2. | ||||
| CVE-2026-114740 | 2026-10-26 | 4.9 Medium | ||
| The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish. | ||||
| CVE-2026-112828 | 2026-10-26 | 4.3 Medium | ||
| Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6. | ||||
| CVE-2026-110377 | 2026-10-26 | 5.3 Medium | ||
| Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3. | ||||
| CVE-2026-110376 | 2026-10-26 | 4.3 Medium | ||
| Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through 1.0.10. | ||||
| CVE-2026-116107 | 1 Datafeedr | 1 Product Sets Plugin | 2026-10-26 | 5.4 Medium |
| A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-97851 | 1 J4care | 1 Dcm4chee-arc-light | 2026-10-25 | 9.1 Critical |
| The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database. | ||||
| CVE-2026-105888 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-10-25 | 5.4 Medium |
| Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1. | ||||
| CVE-2026-105055 | 2 Wordpress-extensions, Wpmailster | 2 Wp Mailster, Wp Mailster | 2026-10-25 | 5.3 Medium |
| Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through 1.9.0.0. | ||||
| CVE-2026-116208 | 1 Yeswiki | 1 Yeswiki | 2026-10-25 | 8.1 High |
| YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries. | ||||
| CVE-2026-116052 | 1 Linkstackorg | 1 Linkstack | 2026-10-25 | 4.3 Medium |
| A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-69945 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-10-25 | 8.8 High |
| Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96315 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-24 | 5.5 Medium |
| Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-107887 | 2026-10-24 | 5.4 Medium | ||
| The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF. | ||||