Total
7017 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-14457 | 1 Codedropz | 1 Contact Form 7 | 2026-01-23 | N/A | 3.7 LOW |
| The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled. | |||||
| CVE-2025-39353 | 1 Themegoods | 1 Grand Restaurant | 2026-01-22 | N/A | 5.3 MEDIUM |
| Missing Authorization vulnerability in ThemeGoods Grand Restaurant WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant WordPress: from n/a through 7.0. | |||||
| CVE-2025-39352 | 1 Themegoods | 1 Grand Restaurant | 2026-01-22 | N/A | 8.2 HIGH |
| Missing Authorization vulnerability in ThemeGoods Grand Restaurant WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant WordPress: from n/a through 7.0. | |||||
| CVE-2025-13781 | 1 Gitlab | 1 Gitlab | 2026-01-22 | N/A | 6.5 MEDIUM |
| GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations. | |||||
| CVE-2023-47180 | 1 Xlplugins | 1 Finale | 2026-01-22 | N/A | 6.5 MEDIUM |
| Missing Authorization vulnerability in XLPlugins Finale Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Finale Lite: from n/a through 2.16.0. | |||||
| CVE-2024-54217 | 1 Reputeinfosystems | 1 Arforms | 2026-01-22 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in Repute info systems ARForms.This issue affects ARForms: from n/a through 6.4.1. | |||||
| CVE-2026-0506 | 1 Sap | 1 Netweaver Application Server Abap | 2026-01-22 | N/A | 8.1 HIGH |
| Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected. | |||||
| CVE-2025-13772 | 1 Gitlab | 1 Gitlab | 2026-01-22 | N/A | 7.1 HIGH |
| GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests. | |||||
| CVE-2025-64729 | 1 Aveva | 1 Process Optimization | 2026-01-22 | N/A | 8.1 HIGH |
| The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and escalate their privileges to the identity of a victim user who subsequently interacts with the project files. | |||||
| CVE-2025-39482 | 1 Imithemes | 1 Eventer | 2026-01-22 | N/A | 4.3 MEDIUM |
| Missing Authorization vulnerability in imithemes Eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a before 3.11.4. | |||||
| CVE-2024-37415 | 1 E2pdf | 1 E2pdf | 2026-01-21 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in E2Pdf.Com allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through 1.20.27. | |||||
| CVE-2024-37440 | 1 Church Admin Project | 1 Church Admin | 2026-01-21 | N/A | 4.3 MEDIUM |
| Missing Authorization vulnerability in Andy Moyle Church Admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 4.4.4. | |||||
| CVE-2024-31281 | 1 Church Admin Project | 1 Church Admin | 2026-01-21 | N/A | 6.3 MEDIUM |
| Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 4.1.6. | |||||
| CVE-2024-30505 | 1 Church Admin Project | 1 Church Admin | 2026-01-21 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 4.1.18. | |||||
| CVE-2025-8944 | 1 Oceanwp | 1 Oceanwp | 2026-01-20 | N/A | 4.3 MEDIUM |
| The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting. | |||||
| CVE-2025-15235 | 1 Quantatw | 1 Qoca Aim | 2026-01-20 | N/A | 6.5 MEDIUM |
| QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Missing Authorization vulnerability, allowing authenticated remote attackers to modify specific network packet parameters, enabling certain system functions to access other users' files. | |||||
| CVE-2024-6845 | 1 Webdigit | 1 Chatbot With Chatgpt | 2026-01-20 | N/A | 5.3 MEDIUM |
| The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key | |||||
| CVE-2026-0676 | 2026-01-20 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zorka: from n/a through <= 1.5.7. | |||||
| CVE-2026-0674 | 2026-01-20 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress forms-for-campaign-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Campaign Monitor for WordPress: from n/a through <= 2.9.0. | |||||
| CVE-2025-69364 | 2026-01-20 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21. | |||||