Export limit exceeded: 13346 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 10993 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10993 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108496 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.23. | ||||
| CVE-2026-108493 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1. | ||||
| CVE-2026-108492 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3. | ||||
| CVE-2026-108174 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4. | ||||
| CVE-2026-106598 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8. | ||||
| CVE-2026-106597 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8. | ||||
| CVE-2026-108718 | 1 Rill Data | 1 Rill | 2026-10-13 | 8.1 High |
| Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions. | ||||
| CVE-2026-108874 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-13 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user a department head, widening department-scoped views, or demote existing heads. | ||||
| CVE-2026-108875 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-13 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to administrator-maintained groups without permission checks. | ||||
| CVE-2026-108884 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-13 | 5.4 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notification templates, causing system notices and workflow reminders to fail. | ||||
| CVE-2026-108891 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-13 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary userId values to retrieve real names, usernames, emails, phone numbers, birthdays, employee numbers, department paths and posts. | ||||
| CVE-2026-109316 | 1 Getgrav | 1 Grav-plugin-data-manager | 2026-10-13 | 6.5 Medium |
| Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks. | ||||
| CVE-2026-108477 | 2 Arraytics, Wordpress-extensions | 2 Booktics, Booktics | 2026-10-13 | 5.3 Medium |
| Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28. | ||||
| CVE-2026-109427 | 1 Weebzone | 1 Telegram-stremio | 2026-10-13 | 6.5 Medium |
| Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation. | ||||
| CVE-2026-108111 | 2 Ageerle, Pandarobot | 2 Ruoyi-ai, Ruoyi Ai | 2026-10-13 | 4.3 Medium |
| ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to list enabled private workflows in the same tenant, including UUIDs and full node and edge configurations. | ||||
| CVE-2026-61994 | 2026-10-12 | 5.4 Medium | ||
| Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7. | ||||
| CVE-2026-108486 | 2026-10-12 | 5.3 Medium | ||
| Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0. | ||||
| CVE-2026-108476 | 2026-10-12 | 5 Medium | ||
| Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13. | ||||
| CVE-2026-108475 | 2026-10-12 | 4.3 Medium | ||
| Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6. | ||||
| CVE-2026-107418 | 2026-10-12 | 5.4 Medium | ||
| Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28. | ||||