Export limit exceeded: 12143 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12143 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-27377 | 2 Axiomthemes, Wordpress | 2 Quickcal - Appointment Booking Calendar For Wordpress, Wordpress | 2026-07-23 | 6.7 Medium |
| Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions. | ||||
| CVE-2026-27399 | 2 Webwizards, Wordpress | 2 Marketking, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions. | ||||
| CVE-2026-27422 | 2 Bplugins, Wordpress | 2 Yt Player, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions. | ||||
| CVE-2026-57425 | 2 Wordpress, Wpdesk | 2 Wordpress, Autopay Dla Woocommerce | 2026-07-23 | 6.5 Medium |
| Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions. | ||||
| CVE-2026-61954 | 2 Payu India, Wordpress | 2 Payu India, Wordpress | 2026-07-23 | 7.5 High |
| Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions. | ||||
| CVE-2026-61972 | 2 Woolentor, Wordpress | 2 Shoplentor Pro, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions. | ||||
| CVE-2026-61973 | 2 Woolentor, Wordpress | 2 Shoplentor Pro, Wordpress | 2026-07-23 | 4.3 Medium |
| Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions. | ||||
| CVE-2026-65457 | 2 Wordpress, Yoomoney | 2 Wordpress, Юkassa Для Woocommerce | 2026-07-23 | 4.3 Medium |
| Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions. | ||||
| CVE-2026-65472 | 2 Kit, Wordpress | 2 Kit (formerly Convertkit), Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions. | ||||
| CVE-2026-65479 | 2 Mvp Themes, Wordpress | 2 Reviewer, Wordpress | 2026-07-23 | 5.4 Medium |
| Subscriber Broken Access Control in Reviewer <= 3.14.2 versions. | ||||
| CVE-2026-65485 | 2 Daniel Iser, Wordpress | 2 Content Control, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions. | ||||
| CVE-2026-65486 | 2 Bastien Ho, Wordpress | 2 Event Post, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Event post <= 6.0.1 versions. | ||||
| CVE-2026-65500 | 2 Pixelacehq, Wordpress | 2 Manual - Documentation, Knowledge Base & Education Wordpress Theme, Wordpress | 2026-07-23 | 7.5 High |
| Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | ||||
| CVE-2026-65524 | 2 Themefusion, Wordpress | 2 Avada Custom Branding, Wordpress | 2026-07-23 | 4.3 Medium |
| Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. | ||||
| CVE-2026-65525 | 2 Uxper, Wordpress | 2 Civi Framework, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. | ||||
| CVE-2026-65537 | 2 Themeisle, Wordpress | 2 Cyr To Lat Reloaded – Transliteration Of Links And File Names, Wordpress | 2026-07-23 | 4.3 Medium |
| Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions. | ||||
| CVE-2026-63097 | 2026-07-23 | 4.3 Medium | ||
| Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Attackers who have left a room can call the rooms context API endpoint for a previously permitted event and receive unfiltered current room state that the /messages and /sync endpoints correctly withhold. | ||||
| CVE-2026-65594 | 1 N8n | 1 N8n | 2026-07-23 | N/A |
| n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. The workflow then runs in the owner's project context with the owner's stored credentials, and the attacker can set tool inputs and read outputs (potentially including data from the owner's connected integrations), breaking user and project isolation. | ||||
| CVE-2026-13078 | 1 Mongodb | 1 Mongodb Server | 2026-07-23 | 7.7 High |
| A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process. | ||||
| CVE-2026-13068 | 1 Mongodb | 1 Mongodb Server | 2026-07-23 | 4.2 Medium |
| An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace. | ||||