Export limit exceeded: 11003 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11003 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109427 | 1 Weebzone | 1 Telegram-stremio | 2026-10-13 | 6.5 Medium |
| Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation. | ||||
| CVE-2026-66651 | 2 Multivendorx, Wordpress | 2 Multivendorx, Wordpress | 2026-10-13 | 6.5 Medium |
| Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.20. | ||||
| CVE-2026-108111 | 2 Ageerle, Pandarobot | 2 Ruoyi-ai, Ruoyi Ai | 2026-10-13 | 4.3 Medium |
| ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to list enabled private workflows in the same tenant, including UUIDs and full node and edge configurations. | ||||
| CVE-2026-61994 | 2026-10-12 | 5.4 Medium | ||
| Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7. | ||||
| CVE-2026-108486 | 2026-10-12 | 5.3 Medium | ||
| Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0. | ||||
| CVE-2026-108476 | 2026-10-12 | 5 Medium | ||
| Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13. | ||||
| CVE-2026-108475 | 2026-10-12 | 4.3 Medium | ||
| Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6. | ||||
| CVE-2026-109666 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits. | ||||
| CVE-2026-109356 | 1 Librenms | 1 Librenms | 2026-10-12 | 4.3 Medium |
| LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices. | ||||
| CVE-2026-109171 | 1 Guchengwuyue | 1 Yshop-crm | 2026-10-12 | 4.3 Medium |
| yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock. | ||||
| CVE-2026-105059 | 2 Royalnavneet, Wordpress-extensions | 2 Delete All Comments Of Wordpress, Delete All Comments Of Wordpress | 2026-10-12 | 6.5 Medium |
| Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1. | ||||
| CVE-2026-109187 | 1 Jishenghua | 1 Jsherp | 2026-10-12 | 6.5 Medium |
| jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrary platformKey values such as email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets, because only aliOss and weixin keys are blocked. | ||||
| CVE-2026-107869 | 2026-10-12 | 4.3 Medium | ||
| Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4. | ||||
| CVE-2026-107863 | 2026-10-12 | 5.3 Medium | ||
| Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7. | ||||
| CVE-2026-107791 | 2026-10-12 | 6.5 Medium | ||
| The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site. | ||||
| CVE-2026-107432 | 2026-10-12 | 5.4 Medium | ||
| Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1. | ||||
| CVE-2026-107430 | 2026-10-12 | 5.4 Medium | ||
| Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10. | ||||
| CVE-2026-107423 | 2026-10-12 | 4.3 Medium | ||
| Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22. | ||||
| CVE-2026-103356 | 2026-10-12 | 5.4 Medium | ||
| Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15. | ||||
| CVE-2026-94538 | 2026-10-11 | 8.1 High | ||
| The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete any file managed by WP File Download, empty the entire trash, move files between categories, and publish or unpublish arbitrary files. | ||||