Export limit exceeded: 29084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 44685 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (44685 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-42706 | 2026-10-11 | 7.5 High | ||
| Unauthenticated Broken Access Control in DK <= 3.2.1 versions. | ||||
| CVE-2026-42705 | 2026-10-11 | 7.5 High | ||
| Unauthenticated Broken Access Control in Grand News <= 3.4 versions. | ||||
| CVE-2026-40808 | 2026-10-11 | 6.5 Medium | ||
| Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. | ||||
| CVE-2026-40802 | 2026-10-11 | 7.6 High | ||
| Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. | ||||
| CVE-2026-40801 | 2026-10-11 | 8.1 High | ||
| Subscriber Broken Access Control in Wordable <= 8.2.10 versions. | ||||
| CVE-2026-40777 | 2026-10-11 | 8.1 High | ||
| Subscriber Broken Access Control in WPSection <= 1.5.1 versions. | ||||
| CVE-2026-107419 | 2026-10-11 | 5.4 Medium | ||
| Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2. | ||||
| CVE-2026-106609 | 2026-10-11 | 7.5 High | ||
| Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2. | ||||
| CVE-2026-103685 | 2026-10-11 | 4.3 Medium | ||
| Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4. | ||||
| CVE-2026-103357 | 2026-10-11 | N/A | ||
| Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3. | ||||
| CVE-2026-108107 | 1 Hotspotbilling | 1 Phpnuxbill | 2026-10-11 | 9.8 Critical |
| PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection. | ||||
| CVE-2026-107841 | 1 John-broadway | 1 Pacioli | 2026-10-11 | 5.7 Medium |
| pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether the marker authorizes cancellation. A credential with API Key Scope.require_consent can submit a caller-controlled Sales Invoice or other supported document under a valid human-minted submit marker and reach Document.cancel() for a different pre-existing submitted document, bypassing the marker's document and act binding, single-use spend, and denial audit. The unauthorized cancellation can reverse the target document's ledger effect; principals without a consent-gated grant are not affected. This issue is fixed in version 0.10.0. | ||||
| CVE-2026-108581 | 1 Tencentcloud | 1 Octop | 2026-10-11 | 6.5 Medium |
| TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts. | ||||
| CVE-2026-108733 | 1 Frappe | 1 Frappe Hr | 2026-10-11 | 4.3 Medium |
| Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance. | ||||
| CVE-2026-108717 | 1 Combodo | 1 Itop | 2026-10-11 | 6.3 Medium |
| Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and get-remote-object routes to delete objects, clear external keys, and read object attributes without permission. | ||||
| CVE-2026-108713 | 1 Suitecrm | 1 Suitecrm | 2026-10-11 | 4.3 Medium |
| SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaigns access can post marketingId, campaignId, and templateId to reattach marketing messages or swap the template EmailMan sends in campaign emails. | ||||
| CVE-2026-96809 | 2026-10-11 | 9.3 Critical | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0. | ||||
| CVE-2026-96330 | 2026-10-11 | 9.3 Critical | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6. | ||||
| CVE-2026-96329 | 2026-10-11 | 8.5 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6. | ||||
| CVE-2026-89304 | 2026-10-11 | 6.5 Medium | ||
| The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks. | ||||