Export limit exceeded: 420305 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 16498 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16498 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-90966 | 2026-11-06 | 4.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price. | ||||
| CVE-2026-86795 | 1 Wordpress-extensions | 1 Community Events | 2026-11-06 | 5.3 Medium |
| The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site. | ||||
| CVE-2026-85346 | 2026-11-06 | 4.3 Medium | ||
| The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts. | ||||
| CVE-2026-118584 | 1 Drupal | 1 Field Permissions | 2026-11-06 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | ||||
| CVE-2026-118583 | 1 Drupal | 1 Field Permissions | 2026-11-06 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | ||||
| CVE-2026-118573 | 1 Drupal | 1 Oauth2 Token Manager | 2026-11-06 | 4.8 Medium |
| Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0. | ||||
| CVE-2026-118567 | 1 Drupal | 1 Bulk Update User Roles | 2026-11-06 | 4.7 Medium |
| Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5. | ||||
| CVE-2026-118548 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 3.7 Low |
| Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118542 | 1 Drupal | 1 Commerce Core | 2026-11-06 | 2.7 Low |
| Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | ||||
| CVE-2026-118541 | 1 Drupal | 1 Commerce Core | 2026-11-06 | 4.3 Medium |
| Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | ||||
| CVE-2026-118540 | 1 Drupal | 1 Commerce Core | 2026-11-06 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0. | ||||
| CVE-2026-114571 | 1 Drupal | 1 Rabbit Hole | 2026-11-06 | 6.5 Medium |
| Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0. | ||||
| CVE-2026-107787 | 2026-11-06 | 3.1 Low | ||
| The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting. | ||||
| CVE-2026-107775 | 2026-11-06 | 2.7 Low | ||
| The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage. | ||||
| CVE-2026-107773 | 2026-11-06 | 6.5 Medium | ||
| The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders. | ||||
| CVE-2026-123326 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.1 High |
| In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension | ||||
| CVE-2026-123323 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 8.4 High |
| In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation | ||||
| CVE-2026-123335 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.5 Low |
| In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection | ||||
| CVE-2026-123337 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.1 Low |
| In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility | ||||
| CVE-2026-115431 | 2026-11-06 | 7.1 High | ||
| Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6. | ||||