Export limit exceeded: 405258 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 15089 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15089 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107507 | 2026-10-11 | 2.7 Low | ||
| The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to. | ||||
| CVE-2026-86706 | 2026-10-11 | 9.1 Critical | ||
| The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable. | ||||
| CVE-2026-108732 | 1 Frappe | 2 Frappe Hr, Hrms | 2026-10-11 | 4.3 Medium |
| Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances. | ||||
| CVE-2026-108734 | 1 Frappe | 1 Crm | 2026-10-11 | 4.3 Medium |
| Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text. | ||||
| CVE-2026-108729 | 1 Cortezaproject | 1 Corteza | 2026-10-11 | 5.9 Medium |
| Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries. | ||||
| CVE-2026-108710 | 1 Orneryd | 1 Nornicdb | 2026-10-11 | 6.5 Medium |
| NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs to retrieve node IDs, labels and full property maps. | ||||
| CVE-2026-108851 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-11 | 3.3 Low |
| phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups. | ||||
| CVE-2026-108697 | 1 Coreshop | 1 Coreshop | 2026-10-11 | 4.3 Medium |
| CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacking resource permissions can request the generated list routes to enumerate payment providers, carriers, price rules, stores, and tax rules including ids, names, and identifiers. | ||||
| CVE-2026-96334 | 2026-10-11 | 5.6 Medium | ||
| Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7. | ||||
| CVE-2026-95597 | 2026-10-11 | 6.5 Medium | ||
| Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17. | ||||
| CVE-2026-93950 | 2026-10-11 | 7.5 High | ||
| Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108. | ||||
| CVE-2026-65459 | 2026-10-11 | 7.5 High | ||
| Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. | ||||
| CVE-2026-62118 | 2026-10-11 | 7.3 High | ||
| Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. | ||||
| CVE-2026-62035 | 2026-10-11 | 6.3 Medium | ||
| Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions. | ||||
| CVE-2026-62033 | 2026-10-11 | 7.6 High | ||
| Subscriber Settings Change in uListing <= 2.2.0 versions. | ||||
| CVE-2026-62028 | 2026-10-11 | 5.4 Medium | ||
| Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21. | ||||
| CVE-2026-42706 | 2026-10-11 | 7.5 High | ||
| Unauthenticated Broken Access Control in DK <= 3.2.1 versions. | ||||
| CVE-2026-42705 | 2026-10-11 | 7.5 High | ||
| Unauthenticated Broken Access Control in Grand News <= 3.4 versions. | ||||
| CVE-2026-40808 | 2026-10-11 | 6.5 Medium | ||
| Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. | ||||
| CVE-2026-40802 | 2026-10-11 | 7.6 High | ||
| Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. | ||||