Total
8914 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59560 | 2 Roxnor, Wordpress | 2 Fundengine, Wordpress | 2026-07-27 | 6.5 Medium |
| Subscriber Broken Access Control in FundEngine <= 1.7.8 versions. | ||||
| CVE-2026-59534 | 2 Aurovrata Venet, Wordpress | 2 Post My Cf7 Form, Wordpress | 2026-07-27 | 7.5 High |
| Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | ||||
| CVE-2026-59530 | 2 Paymentplugins, Wordpress | 2 Stripe For Woocommerce, Wordpress | 2026-07-27 | 7.5 High |
| Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. | ||||
| CVE-2026-57705 | 2 Nexcess, Wordpress | 2 Event Tickets, Wordpress | 2026-07-27 | 7.5 High |
| Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5. | ||||
| CVE-2026-49326 | 1 Apache | 1 Hbase | 2026-07-27 | 6.5 Medium |
| Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users. This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*. Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue. | ||||
| CVE-2026-59690 | 2 Process Software, Progress | 5 Multi Tenant, Ecs Connection Manager, Loadmaster and 2 more | 2026-07-27 | 8 High |
| A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise. | ||||
| CVE-2026-59535 | 2 Thrive Themes Coupon, Wordpress | 2 Thrive Product Manager, Wordpress | 2026-07-27 | 7.3 High |
| Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. | ||||
| CVE-2026-44770 | 1 Sap Se | 1 Sap S/4 Hana (create Single Payment) | 2026-07-27 | 4.3 Medium |
| SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys resulting in disclosure of information. This has low impact on confidentiality, with no impact on integrity and availability of the application. | ||||
| CVE-2026-44771 | 1 Sap Se | 1 Sap S/4hana (draft Operation) | 2026-07-27 | 4.3 Medium |
| SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges. This results in low impact on confidentiality, with no impact on integrity and availability of the application. | ||||
| CVE-2026-11802 | 2 Themelooks, Wordpress | 2 Foodbook Lite – Online Food Ordering System, Wordpress | 2026-07-27 | 5.3 Medium |
| The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the 'customer' role and receive authentication cookies, even when the site administrator has explicitly disabled user registration. | ||||
| CVE-2026-46459 | 1 Icu Scandinavia | 1 Boomerang | 2026-07-27 | N/A |
| ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029 | ||||
| CVE-2026-10033 | 2 Eventon, Wordpress | 2 Eventon Action User, Wordpress | 2026-07-27 | 7.3 High |
| The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON management capabilities and the upload_files capability to any non-administrator WordPress role or user, escalating their privileges within the site. The administrator role is protected by an early-return guard in update_role_caps(), so only non-administrator roles and individual users can be targeted; however, the same unauthenticated exposure also allows attackers to enumerate all WordPress users with their IDs and display names, disclose role and user capability state along with nonce values, and tamper with event-to-user term assignments. | ||||
| CVE-2026-66027 | 1 Kortix-ai | 1 Suna | 2026-07-25 | 8.3 High |
| Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues of all users, read or delete individual sessions, and inject arbitrary prompts into another user's session queue, causing the background drainer to forward malicious messages to the victim's running AI agent with the victim's credentials and permissions. | ||||
| CVE-2026-11354 | 2 Wordpress, Xnau | 2 Wordpress, Participants Database | 2026-07-24 | 5.3 Medium |
| The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the private_id-bearing record-access link to an attacker-controlled email address, granting full read and edit access to the victim's stored personally identifiable information including names, email addresses, phone numbers, and any other fields collected in the participant database. An attacker can harvest a valid nonce with a plain unauthenticated GET request to any page rendering the public signup or record form, then POST action=update with an arbitrary id value to overwrite any record; chaining a subsequent action=retrieve then delivers the private-access link to the attacker-controlled mailbox. | ||||
| CVE-2026-12690 | 2 Profilegrid, Wordpress | 2 Profilegrid, Wordpress | 2026-07-24 | 3.8 Low |
| The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings. | ||||
| CVE-2026-12689 | 2 Profilegrid, Wordpress | 2 Profilegrid, Wordpress | 2026-07-24 | 5.4 Medium |
| The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads. | ||||
| CVE-2026-58275 | 1 Microsoft | 1 Azure Dns | 2026-07-24 | 10 Critical |
| Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-15350 | 2 Kevp75, Wordpress | 2 The Cache Purger, Wordpress | 2026-07-23 | 4.3 Medium |
| The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently truncate the plugin's cache-purge audit log (wp-content/purge.log), destroying the entire cache-purge audit history. The tcp_log_purge nonce is rendered in the admin bar on frontend pages accessible to all authenticated users including subscribers, meaning any authenticated user possesses the nonce required to trigger the deletion. | ||||
| CVE-2026-57205 | 1 Microsoft | 1 Simplechat | 2026-07-23 | 4.3 Medium |
| SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203. | ||||
| CVE-2026-57206 | 1 Microsoft | 1 Simplechat | 2026-07-23 | 8.6 High |
| SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/single_app/plugin_validation_endpoint.py, including `POST /api/admin/plugins/test-instantiation`, `GET /api/admin/plugins/health-check/<plugin_name>`, `POST /api/admin/plugins/repair/<plugin_name>`, and `POST /api/plugins/validate`, relied on @swagger_route(security=get_auth_security()) documentation without enforcing @login_required, @user_required, or @admin_required at runtime, allowing unauthenticated or unauthorized clients to invoke plugin validation, health, and repair behavior. This issue is fixed in version 0.241.206. | ||||