Export limit exceeded: 16031 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16031 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-52708 | 2 Wedevs, Wordpress-extensions | 2 Wp User Frontend, Wp User Frontend | 2026-10-29 | 4.3 Medium |
| Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13. | ||||
| CVE-2026-115605 | 3 Brainstorm Force, Brainstormforce, Wordpress-extensions | 3 Suredash, Suredash, Suredash | 2026-10-29 | 4.3 Medium |
| Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3. | ||||
| CVE-2026-119115 | 1 Aws | 1 Aws-privateca-issuer | 2026-10-29 | 8.5 High |
| Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. To remediate this issue, users should upgrade aws-privateca-issuer to version v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1, and update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, since v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer and to match the issuer it references. | ||||
| CVE-2026-107017 | 2026-10-29 | N/A | ||
| Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions. | ||||
| CVE-2026-118669 | 2026-10-29 | 8.1 High | ||
| OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0. | ||||
| CVE-2026-19610 | 1 Redhat | 5 Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack, Jbosseapxp and 2 more | 2026-10-29 | 6.5 Medium |
| A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted. | ||||
| CVE-2026-100404 | 1 Zulip | 1 Zulip | 2026-10-29 | 6.5 Medium |
| Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribed public channel, or an existing event queue can remain affected after the guest's access to the channel is removed. The flaw discloses new public-channel messages to the guest. This issue is fixed in version 12.2. | ||||
| CVE-2026-39735 | 2 Crocoblock, Wordpress-extensions | 2 Jetengine, Jetengine | 2026-10-29 | 6.5 Medium |
| Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1. | ||||
| CVE-2026-109891 | 2026-10-29 | 6.4 Medium | ||
| Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1. | ||||
| CVE-2026-25448 | 2026-10-29 | 4.3 Medium | ||
| Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10. | ||||
| CVE-2026-114619 | 1 Authlib | 1 Authlib | 2026-10-29 | 4.6 Medium |
| Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client permitted an ID token response type but not the openid scope can add openid to the request, obtain user consent, and receive a signed ID token containing the user's subject and allowed profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID token response are not affected. In authlib/oidc/core/grants/implicit.py, OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered request.scope. This issue is fixed in version 1.9.0. | ||||
| CVE-2026-116498 | 1 Kiali | 1 Kiali | 2026-10-29 | 4.3 Medium |
| A missing authorization flaw was found in Kiali, where the namespace health, ztunnel pod log, and ztunnel configuration dump API endpoints returned data about namespaces the caller had no RBAC access to, reading ztunnel data with the Kiali ServiceAccount without checking the caller's permissions. Additionally, the openshift authentication strategy accepted tokens that could not view any namespace. An attacker with any valid OpenShift token could read other tenants' workload names, health, traffic topology, workload identities, pod addresses and mesh policies, resulting in information disclosure across tenant boundaries. | ||||
| CVE-2026-54852 | 2026-10-29 | 5.3 Medium | ||
| Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1. | ||||
| CVE-2026-27063 | 2026-10-29 | 5.3 Medium | ||
| Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7. | ||||
| CVE-2026-115601 | 2026-10-29 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29. | ||||
| CVE-2026-54871 | 2026-10-29 | 5.3 Medium | ||
| Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.2. | ||||
| CVE-2026-25450 | 2026-10-29 | 5.3 Medium | ||
| Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0. | ||||
| CVE-2026-114181 | 2026-10-29 | 5.3 Medium | ||
| Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6. | ||||
| CVE-2026-118088 | 2026-10-29 | 5.3 Medium | ||
| Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5. | ||||
| CVE-2026-118091 | 2026-10-29 | 5.3 Medium | ||
| Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5. | ||||