Export limit exceeded: 13997 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (13997 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-74933 | 2026-09-14 | 8.8 High | ||
| The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page. | ||||
| CVE-2026-68535 | 1 Concretecms | 1 Concrete Cms | 2026-09-14 | N/A |
| Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the referenced file is authorized against the user's file-manager visibility. As a result, an authenticated user holding the block-add scope could store, and cause the page to render, a reference to a file that the file-manager authorization policy would otherwise reject, disclosing that file's URL and preview to the editor and to visitors of the affected page. Under public file storage, the URL and thumbnail are exposed directly; under private storage, the disclosure is limited by the permission-checked download URL. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks riodrwn for reporting. | ||||
| CVE-2026-53638 | 1 Sylius | 1 Sylius | 2026-09-14 | 4.3 Medium |
| Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application. | ||||
| CVE-2026-8821 | 1 Mattermost | 1 Mattermost | 2026-09-14 | 7.1 High |
| Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field.. Mattermost Advisory ID: MMSA-2026-00677 | ||||
| CVE-2026-20773 | 1 Ping Identity | 1 Pingfederate | 2026-09-14 | N/A |
| A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions. | ||||
| CVE-2026-14344 | 1 Mattermost | 1 Mattermost | 2026-09-14 | 4.3 Medium |
| Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory ID: MMSA-2026-00715 | ||||
| CVE-2026-86085 | 1 N8n | 1 N8n | 2026-09-14 | 4.9 Medium |
| n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the caller could not list and obtain member names and email addresses. The affected controller is packages/cli/src/controllers/role.controller.ts, which omitted the project:list scope check. This issue is fixed in versions 2.37.7 and 2.38.2. | ||||
| CVE-2026-90895 | 1 Misp | 1 Misp | 2026-09-14 | N/A |
| Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users; - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view(); - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked; - server synchronization authkey values were not explicitly hidden from CLI detail output; - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised(); - the use command could establish context for a record without first proving that the user was authorized to view that record The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch. Version affected: ≤2.5.45 | ||||
| CVE-2025-53341 | 2 Themovation, Wordpress | 2 Stratus, Wordpress | 2026-09-14 | 4.3 Medium |
| Missing Authorization vulnerability in Pixel Makers Creative INC. App, SaaS & Software Startup Tech Theme - Stratus allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects App, SaaS & Software Startup Tech Theme - Stratus: from n/a before 4.2.11. | ||||
| CVE-2026-86418 | 2 Misp, Misp-project | 2 Misp, Misp | 2026-09-14 | 4.3 Medium |
| Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID; - name. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them. The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility. Version affected: ≤2.5.45 | ||||
| CVE-2026-69403 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-13 | 5.5 Medium |
| Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69453 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-13 | 5.5 Medium |
| Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-78626 | 1 Okta | 1 Access Gateway | 2026-09-13 | 8.1 High |
| The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources. | ||||
| CVE-2026-12956 | 2 Arraytics, Wordpress | 2 Eventin – Event Calendar, Event Registration, Tickets & Booking (ai Powered), Wordpress | 2026-09-13 | 5.3 Medium |
| The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory. | ||||
| CVE-2026-11821 | 2 Arraytics, Wordpress | 2 Eventin – Event Calendar, Event Registration, Tickets & Booking (ai Powered), Wordpress | 2026-09-13 | 5.4 Medium |
| The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators. | ||||
| CVE-2026-19946 | 2 Awesomesupport, Wordpress | 2 Awesome Support Wordpress Helpdesk & Support, Wordpress | 2026-09-13 | 4.3 Medium |
| The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim. | ||||
| CVE-2026-8615 | 2 Ghera74, Wordpress | 2 Ilghera Support System For Woocommerce, Wordpress | 2026-09-13 | 4.3 Medium |
| The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service. | ||||
| CVE-2026-81794 | 2 Mlfactory, Wordpress | 2 Shirt Product Designer For Woocommerce, Wordpress | 2026-09-13 | 7.5 High |
| Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions. | ||||
| CVE-2026-81801 | 2 Udx Usability Dynamics, Wordpress | 2 Wp-stateless, Wordpress | 2026-09-13 | 8.1 High |
| Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. | ||||
| CVE-2026-89054 | 1 The Opennms Group | 1 Horizon | 2026-09-13 | 8.2 High |
| A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are reachable with no authorization enforced. An unauthenticated attacker able to reach the web UI can disable event definitions and SNMP data collection, suppressing event and alarm generation and stopping metric collection - silently degrading monitoring and detection - with the change persisted and reloaded into the running system. The solution is to upgrade to Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. | ||||