Export limit exceeded: 16802 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16802 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113754 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-11 | 4.7 Medium |
| Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-125434 | 2026-11-11 | 5.4 Medium | ||
| Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235. | ||||
| CVE-2026-125439 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0. | ||||
| CVE-2026-124413 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4. | ||||
| CVE-2026-115600 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3. | ||||
| CVE-2026-122671 | 2026-11-11 | 6.5 Medium | ||
| Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through 1.32.65. | ||||
| CVE-2026-124271 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3. | ||||
| CVE-2026-125444 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through 51.1.87. | ||||
| CVE-2026-19685 | 1 Redhat | 7 Enterprise Linux, Hardened Images, Hummingbird and 4 more | 2026-11-11 | 7.1 High |
| NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point. | ||||
| CVE-2026-15939 | 1 Wordpress-extensions | 1 Simple Restrict | 2026-11-11 | 2.7 Low |
| The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to. | ||||
| CVE-2026-16042 | 1 Wordpress-extensions | 1 Lws Optimize | 2026-11-11 | 4.3 Medium |
| The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds. | ||||
| CVE-2026-16285 | 1 Wordpress-extensions | 1 Woocommerce Product Attachment | 2026-11-11 | 7.5 High |
| The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID. | ||||
| CVE-2026-16064 | 1 Wordpress-extensions | 1 Event Booking Manager For Woocommerce | 2026-11-11 | 5.4 Medium |
| The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own. | ||||
| CVE-2026-16274 | 1 Wordpress-extensions | 1 Classified Listing | 2026-11-11 | 2.7 Low |
| The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership. | ||||
| CVE-2026-16276 | 1 Wordpress-extensions | 1 Classified Listing | 2026-11-11 | 2.7 Low |
| The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers. | ||||
| CVE-2026-15958 | 1 Wordpress-extensions | 1 Easy Dropbox Integration | 2026-11-11 | 9.3 Critical |
| The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses. | ||||
| CVE-2026-16546 | 1 Wordpress-extensions | 1 Wired Impact Volunteer Management | 2026-11-11 | 4.3 Medium |
| The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity. | ||||
| CVE-2026-16561 | 1 Wordpress-extensions | 1 Sunshine Photo Cart | 2026-11-11 | 7.5 High |
| The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries. | ||||
| CVE-2026-16603 | 1 Wordpress-extensions | 1 Passster | 2026-11-11 | 7.5 High |
| The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API. | ||||
| CVE-2026-15246 | 1 Wordpress-extensions | 1 Realhomes Memberships | 2026-11-11 | 4.3 Medium |
| The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages without paying. | ||||