Export limit exceeded: 12155 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12155 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59530 | 2 Paymentplugins, Wordpress | 2 Stripe For Woocommerce, Wordpress | 2026-07-27 | 7.5 High |
| Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. | ||||
| CVE-2026-57705 | 2 Nexcess, Wordpress | 2 Event Tickets, Wordpress | 2026-07-27 | 7.5 High |
| Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5. | ||||
| CVE-2026-49326 | 1 Apache | 1 Hbase | 2026-07-27 | 6.5 Medium |
| Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users. This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*. Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue. | ||||
| CVE-2026-59690 | 2 Process Software, Progress | 5 Multi Tenant, Ecs Connection Manager, Loadmaster and 2 more | 2026-07-27 | 8 High |
| A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise. | ||||
| CVE-2026-59534 | 2 Aurovrata Venet, Wordpress | 2 Post My Cf7 Form, Wordpress | 2026-07-27 | 7.5 High |
| Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | ||||
| CVE-2026-59535 | 2 Thrive Themes Coupon, Wordpress | 2 Thrive Product Manager, Wordpress | 2026-07-27 | 7.3 High |
| Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. | ||||
| CVE-2026-66012 | 1 Siyuan | 1 Siyuan | 2026-07-27 | 10 Critical |
| SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy actions across the entire workspace. When the Publish server is enabled in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false), the Publish reverse proxy attaches an anonymous RoleReader JWT to proxied requests, allowing a remote unauthenticated attacker to reach /mcp. The attacker can read conf/conf.json to extract accessAuthCode, api.token, and cookieKey in plaintext, write arbitrary files in the workspace, and plant a plugin into data/plugins/ that executes with nodeIntegration:true and no contextIsolation on the next desktop launch, leading to administrator takeover. | ||||
| CVE-2026-59689 | 1 Progress | 4 Ecs Connection Manager, Loadmaster, Moveit Waf and 1 more | 2026-07-27 | 8 High |
| An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise. | ||||
| CVE-2026-17529 | 1 Astrbot | 1 Astrbot | 2026-07-27 | 6.3 Medium |
| A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the argument req.func_tool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is d23011262e8e75e1ec41b0f1f0091493a022327e. It is suggested to install a patch to address this issue. | ||||
| CVE-2026-59536 | 2026-07-27 | 7.5 High | ||
| Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. | ||||
| CVE-2026-62187 | 1 Openclaw | 1 Feishu | 2026-07-27 | 8.1 High |
| OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue is fixed in version 2026.6.9. Impact depends on the operator's configuration and whether lower-trust input can reach the affected feature. | ||||
| CVE-2026-62188 | 1 Openclaw | 1 Feishu | 2026-07-27 | 8.1 High |
| OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. The issue is fixed in version 2026.6.9. | ||||
| CVE-2026-44770 | 1 Sap Se | 1 Sap S/4 Hana (create Single Payment) | 2026-07-27 | 4.3 Medium |
| SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys resulting in disclosure of information. This has low impact on confidentiality, with no impact on integrity and availability of the application. | ||||
| CVE-2026-44771 | 1 Sap Se | 1 Sap S/4hana (draft Operation) | 2026-07-27 | 4.3 Medium |
| SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges. This results in low impact on confidentiality, with no impact on integrity and availability of the application. | ||||
| CVE-2026-11802 | 2 Themelooks, Wordpress | 2 Foodbook Lite – Online Food Ordering System, Wordpress | 2026-07-27 | 5.3 Medium |
| The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the 'customer' role and receive authentication cookies, even when the site administrator has explicitly disabled user registration. | ||||
| CVE-2026-65435 | 2026-07-27 | 6.5 Medium | ||
| Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions. | ||||
| CVE-2026-45075 | 1 Symfony | 3 Http-kernel, Security-http, Symfony | 2026-07-27 | N/A |
| Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12. | ||||
| CVE-2026-48489 | 1 Symfony | 2 Security-http, Symfony | 2026-07-27 | N/A |
| Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13. | ||||
| CVE-2026-48348 | 1 Adobe | 2 Adobe Animate 2023, Adobe Animate 2024 | 2026-07-27 | 7.7 High |
| Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-48349 | 1 Adobe | 2 Adobe Animate 2023, Adobe Animate 2024 | 2026-07-27 | 8.1 High |
| Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed. | ||||