Total
6561 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59912 | 2026-08-03 | 7.8 High | ||
| Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and arbitrary code execution. | ||||
| CVE-2026-16064 | 2026-08-03 | 5.4 Medium | ||
| The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own. | ||||
| CVE-2026-15241 | 2026-08-03 | 7.5 High | ||
| The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional feature is enabled, to retrieve indexed knowledge-base content. | ||||
| CVE-2026-15151 | 2026-08-03 | 7.5 High | ||
| The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules. | ||||
| CVE-2026-16565 | 2 Dokan, Wordpress | 2 Ai Powered Woocommerce Multivendor Marketplace Solution, Wordpress | 2026-08-03 | 4.3 Medium |
| The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor's products on the marketplace. | ||||
| CVE-2026-52134 | 1 Mz-automation | 1 Libiec61850 | 2026-08-03 | 9.8 Critical |
| An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame. | ||||
| CVE-2026-16289 | 2 Profilegrid, Wordpress | 2 Profilegrid, Wordpress | 2026-08-03 | 4.3 Medium |
| The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones. | ||||
| CVE-2026-43760 | 1 Apple | 1 Macos | 2026-08-03 | 8.6 High |
| An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data. | ||||
| CVE-2026-56608 | 1 Hcltech | 1 Icontrol | 2026-08-03 | 3.7 Low |
| HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization. | ||||
| CVE-2026-64737 | 1 Apple | 1 Macos | 2026-08-03 | 8.2 High |
| An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox. | ||||
| CVE-2026-58039 | 1 Nodejs | 1 Nodejs | 2026-08-03 | N/A |
| A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. | ||||
| CVE-2026-14840 | 2 Wordpress, Yop-poll | 2 Wordpress, Yop-poll | 2026-08-03 | N/A |
| The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll. | ||||
| CVE-2026-15248 | 2026-08-03 | N/A | ||
| The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users. | ||||
| CVE-2026-15939 | 2026-08-03 | N/A | ||
| The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to. | ||||
| CVE-2026-16256 | 2026-08-03 | N/A | ||
| The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site. | ||||
| CVE-2026-16042 | 2026-08-03 | N/A | ||
| The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds. | ||||
| CVE-2026-16292 | 2 Frontend File Manager Plugin, Wordpress | 2 Frontend File Manager Plugin, Wordpress | 2026-08-03 | N/A |
| The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file. | ||||
| CVE-2026-16563 | 2 Academylms, Wordpress | 2 Academy Lms, Wordpress | 2026-08-03 | N/A |
| The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons. | ||||
| CVE-2026-16274 | 2026-08-03 | N/A | ||
| The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership. | ||||
| CVE-2026-16534 | 2026-08-03 | N/A | ||
| The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email. | ||||