Export limit exceeded: 11778 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11778 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119653 | 1 Admpub | 1 Nging | 2026-10-30 | 4.3 Medium |
| Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist. | ||||
| CVE-2026-119763 | 1 Thechangelog | 1 Changelog.com | 2026-10-30 | 5.3 Medium |
| changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items. | ||||
| CVE-2026-13747 | 2 Tigroumeow, Wordpress-extensions | 2 Meow Gallery, Meow Gallery | 2026-10-30 | 6.5 Medium |
| The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users. | ||||
| CVE-2026-114487 | 1 Devolutions | 1 Server | 2026-10-30 | 4.3 Medium |
| Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request. | ||||
| CVE-2026-62019 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Bookit, Bookit | 2026-10-30 | 4.3 Medium |
| Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6. | ||||
| CVE-2026-62023 | 2 Unlimited-elements, Wordpress-extensions | 2 Unlimited Elements For Elementor, Unlimited Elements For Elementor | 2026-10-30 | 4.3 Medium |
| Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26. | ||||
| CVE-2026-116853 | 2 Nexcess, Wordpress-extensions | 2 Givewp, Givewp | 2026-10-30 | 6.5 Medium |
| Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. | ||||
| CVE-2026-78403 | 1 Thalesgroup | 1 Sentinel Keys Server | 2026-10-30 | 9.8 Critical |
| Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\SYSTEM. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0. | ||||
| CVE-2026-86987 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-10-30 | 5.5 Medium |
| An authorization issue was addressed with improved entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. A remote attacker may be able to access sensitive user data. | ||||
| CVE-2026-96391 | 1 Drupal | 1 Webform | 2026-10-30 | 4.3 Medium |
| Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1. | ||||
| CVE-2026-68482 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-30 | 5.3 Medium |
| Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-54850 | 2026-10-30 | 6.5 Medium | ||
| Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions. | ||||
| CVE-2026-116862 | 2026-10-30 | 7.5 High | ||
| Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. | ||||
| CVE-2026-104674 | 2 Arraytics, Wordpress-extensions | 2 Booktics, Booktics | 2026-10-30 | 4.3 Medium |
| Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31. | ||||
| CVE-2026-116410 | 2026-10-30 | 6.5 Medium | ||
| Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. | ||||
| CVE-2026-119702 | 2 Wordpress-extensions, Wpgraphql | 2 Wpgraphql, Wpgraphql | 2026-10-30 | 6.5 Medium |
| WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks. | ||||
| CVE-2026-62056 | 2026-10-30 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6. | ||||
| CVE-2026-54852 | 2026-10-30 | 5.3 Medium | ||
| Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1. | ||||
| CVE-2026-27063 | 2026-10-30 | 5.3 Medium | ||
| Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7. | ||||
| CVE-2026-119087 | 2026-10-30 | 4.3 Medium | ||
| The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to create posts attributed to another user's account — typically an administrator — by supplying an admin-owned preset_id, causing wp_insert_post to record the administrator as post_author. This includes the ability to create published posts when the attacker already holds publish_posts capability for the preset's post type, resulting in administrator-attributed published content created by a lower-privileged user. | ||||