Export limit exceeded: 11934 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11934 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-62035 | 2026-10-11 | 6.3 Medium | ||
| Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions. | ||||
| CVE-2026-62033 | 2026-10-11 | 7.6 High | ||
| Subscriber Settings Change in uListing <= 2.2.0 versions. | ||||
| CVE-2026-62028 | 2026-10-11 | 5.4 Medium | ||
| Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21. | ||||
| CVE-2026-42706 | 2026-10-11 | 7.5 High | ||
| Unauthenticated Broken Access Control in DK <= 3.2.1 versions. | ||||
| CVE-2026-42705 | 2026-10-11 | 7.5 High | ||
| Unauthenticated Broken Access Control in Grand News <= 3.4 versions. | ||||
| CVE-2026-40808 | 2026-10-11 | 6.5 Medium | ||
| Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. | ||||
| CVE-2026-40801 | 2026-10-11 | 8.1 High | ||
| Subscriber Broken Access Control in Wordable <= 8.2.10 versions. | ||||
| CVE-2026-40777 | 2026-10-11 | 8.1 High | ||
| Subscriber Broken Access Control in WPSection <= 1.5.1 versions. | ||||
| CVE-2026-107419 | 2026-10-11 | 5.4 Medium | ||
| Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2. | ||||
| CVE-2026-106609 | 2026-10-11 | 7.5 High | ||
| Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2. | ||||
| CVE-2026-103685 | 2026-10-11 | 4.3 Medium | ||
| Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4. | ||||
| CVE-2026-103357 | 2026-10-11 | N/A | ||
| Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3. | ||||
| CVE-2026-105989 | 2026-10-10 | 5.3 Medium | ||
| The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts. | ||||
| CVE-2026-62128 | 2 Creator Lms, Wordpress-extensions | 2 Creator Lms, Creator Lms | 2026-10-10 | 5.3 Medium |
| Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21. | ||||
| CVE-2026-96461 | 2026-10-09 | 7.5 High | ||
| Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10. | ||||
| CVE-2026-95589 | 2026-10-09 | 6.5 Medium | ||
| Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1. | ||||
| CVE-2026-62042 | 2026-10-09 | 5.3 Medium | ||
| Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8. | ||||
| CVE-2026-105883 | 2026-10-09 | 7.1 High | ||
| Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1. | ||||
| CVE-2026-73665 | 2 Freepbx, Sangoma | 2 Ucp, Freepbx | 2026-10-09 | 9.8 Critical |
| FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9. | ||||
| CVE-2026-79842 | 1 Hewlett Packard Enterprise(hpe) | 1 Intelligent Management Center | 2026-10-09 | 9.1 Critical |
| An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713 | ||||