| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions. |
| Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions. |
| Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions. |
| Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions. |
| Subscriber Broken Access Control in Reviewer <= 3.14.2 versions. |
| Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions. |
| Unauthenticated Broken Access Control in Event post <= 6.0.1 versions. |
| Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. |
| Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. |
| Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. |
| Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions. |
| A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process. |
| Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers. |
| Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. |
| ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue. |
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session |
| Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions. |
| Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions. |
| Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions. |
| Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions. |
