Export limit exceeded: 15737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15737 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-94273 | 1 Wordpress-extensions | 1 Snap Finance | 2026-10-21 | 5.3 Medium |
| The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment. | ||||
| CVE-2026-106010 | 1 Wordpress-extensions | 1 Bdm Digital Payment Gateway | 2026-10-21 | 5.3 Medium |
| The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration. | ||||
| CVE-2026-94272 | 1 Wordpress-extensions | 1 Snap Finance | 2026-10-21 | 5.3 Medium |
| The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail. | ||||
| CVE-2026-94294 | 1 Wordpress-extensions | 1 App Builder | 2026-10-21 | 5.3 Medium |
| The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data. | ||||
| CVE-2026-111439 | 1 Opengauss-server | 1 Opengauss-server | 2026-10-21 | 4.3 Medium |
| 在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 is_row_data_file() 也仅用于识别文件形态，未包含权限检查。因此，任何拥有普通数据库连接权限的用户，只要能够通过 pg_relation_filepath() 等函数获取到目标表的底层关系文件路径（例如压缩数据的 _compress 文件路径），即可无需具备该表的 SELECT 权限，直接读取表数据的二进制块。 此漏洞影响此前3.0.0到6.0.0间的所有版本及补丁版，并在7.0.0-LTS版本修复。修复patch详见：https://gitcode.com/opengauss/openGauss-server/pull/9374。 | ||||
| CVE-2026-111839 | 2 Videowhisper, Wordpress-extensions | 2 Broadcast Live Video, Broadcast Live Video | 2026-10-21 | 5.3 Medium |
| Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7. | ||||
| CVE-2026-111836 | 2 Wordpress-extensions, Wpmanageninja | 2 Fluentcommunity, Fluentcommunity | 2026-10-21 | 4.3 Medium |
| Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0. | ||||
| CVE-2026-111831 | 2 Wordpress-extensions, Wpmanageninja | 2 Fluentform, Fluent Forms | 2026-10-21 | 5.3 Medium |
| Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15. | ||||
| CVE-2026-111845 | 2 Wordpress-extensions, Yithemes | 2 Yith Woocommerce Product Bundles, Yith Woocommerce Product Bundles | 2026-10-21 | 5.3 Medium |
| Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0. | ||||
| CVE-2026-112222 | 2 Surfer, Wordpress-extensions | 2 Surfer, Surfer | 2026-10-21 | 5.4 Medium |
| Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744. | ||||
| CVE-2026-112262 | 1 Risingwavelabs | 1 Risingwave | 2026-10-21 | 7.1 High |
| RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root. | ||||
| CVE-2026-112291 | 1 Flarum | 1 Extension Manager | 2026-10-21 | 5.3 Medium |
| Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version. | ||||
| CVE-2026-112292 | 1 Operacle | 1 Checkcle | 2026-10-21 | 9.8 Critical |
| CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data. | ||||
| CVE-2026-112328 | 2 Automattic, Wordpress-extensions | 2 Sensei Lms, Sensei Lms | 2026-10-21 | 4.3 Medium |
| The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own. | ||||
| CVE-2026-111058 | 1 Mljar | 1 Mercury | 2026-10-21 | 9.8 Critical |
| Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6. | ||||
| CVE-2024-10306 | 1 Redhat | 3 Enterprise Linux, Jboss Core Services, Rhel Eus | 2026-10-21 | 5.4 Medium |
| A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic. | ||||
| CVE-2026-112070 | 1 Typo3 | 1 Extension Analytics | 2026-10-21 | N/A |
| The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to. | ||||
| CVE-2026-112239 | 1 Typo3 | 1 Extension Typo3 Ai Integration Extension | 2026-10-21 | N/A |
| The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them. | ||||
| CVE-2026-113468 | 1 Typo3 | 1 Extension Typo3 Shop By Coding.ms | 2026-10-21 | N/A |
| The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected. | ||||
| CVE-2026-112071 | 1 Typo3 | 1 Extension Typo3 Shop By Coding.ms | 2026-10-21 | N/A |
| The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected. | ||||