Export limit exceeded: 10782 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16867 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16867 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-62118 2026-10-11 7.3 High
Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
CVE-2026-62035 2026-10-11 6.3 Medium
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.
CVE-2026-62033 2026-10-11 7.6 High
Subscriber Settings Change in uListing <= 2.2.0 versions.
CVE-2026-62028 2026-10-11 5.4 Medium
Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21.
CVE-2026-42706 2026-10-11 7.5 High
Unauthenticated Broken Access Control in DK <= 3.2.1 versions.
CVE-2026-42705 2026-10-11 7.5 High
Unauthenticated Broken Access Control in Grand News <= 3.4 versions.
CVE-2026-40808 2026-10-11 6.5 Medium
Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
CVE-2026-40801 2026-10-11 8.1 High
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
CVE-2026-40777 2026-10-11 8.1 High
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
CVE-2026-107419 2026-10-11 5.4 Medium
Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2.
CVE-2026-106609 2026-10-11 7.5 High
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.
CVE-2026-103685 2026-10-11 4.3 Medium
Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.
CVE-2026-103357 2026-10-11 N/A
Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3.
CVE-2026-107841 1 John-broadway 1 Pacioli 2026-10-11 5.7 Medium
pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether the marker authorizes cancellation. A credential with API Key Scope.require_consent can submit a caller-controlled Sales Invoice or other supported document under a valid human-minted submit marker and reach Document.cancel() for a different pre-existing submitted document, bypassing the marker's document and act binding, single-use spend, and denial audit. The unauthorized cancellation can reverse the target document's ledger effect; principals without a consent-gated grant are not affected. This issue is fixed in version 0.10.0.
CVE-2026-81649 2026-10-11 9.1 Critical
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.
CVE-2026-105989 2026-10-10 5.3 Medium
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.
CVE-2026-105976 2026-10-10 4.7 Medium
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.
CVE-2026-62128 2 Creator Lms, Wordpress-extensions 2 Creator Lms, Creator Lms 2026-10-10 5.3 Medium
Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21.
CVE-2026-106195 2 Apple, Google 2 Macos, Chrome 2026-10-09 9.1 Critical
Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
CVE-2026-96461 2026-10-09 7.5 High
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.