Export limit exceeded: 11923 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11923 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108624 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-13 | 5.4 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remove any message push records, including pending queued messages. | ||||
| CVE-2026-108619 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-13 | 5.4 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint to delete all sys_sms_template rows, breaking template-based notifications such as workflow reminders. | ||||
| CVE-2026-108614 | 1 Jeecg | 2 Jeecg-boot, Jeecg Boot | 2026-10-13 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airag_ext_data evaluator definitions and test-tracking records as an Excel workbook. | ||||
| CVE-2026-108493 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1. | ||||
| CVE-2026-108492 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3. | ||||
| CVE-2026-108174 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4. | ||||
| CVE-2026-106598 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8. | ||||
| CVE-2026-106597 | 2026-10-13 | 5.3 Medium | ||
| Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8. | ||||
| CVE-2026-108477 | 2 Arraytics, Wordpress-extensions | 2 Booktics, Booktics | 2026-10-13 | 5.3 Medium |
| Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28. | ||||
| CVE-2026-66651 | 2 Multivendorx, Wordpress | 2 Multivendorx, Wordpress | 2026-10-13 | 6.5 Medium |
| Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.20. | ||||
| CVE-2026-108111 | 2 Ageerle, Pandarobot | 2 Ruoyi-ai, Ruoyi Ai | 2026-10-13 | 4.3 Medium |
| ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to list enabled private workflows in the same tenant, including UUIDs and full node and edge configurations. | ||||
| CVE-2026-61994 | 2026-10-12 | 5.4 Medium | ||
| Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7. | ||||
| CVE-2026-108486 | 2026-10-12 | 5.3 Medium | ||
| Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0. | ||||
| CVE-2026-108476 | 2026-10-12 | 5 Medium | ||
| Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13. | ||||
| CVE-2026-108475 | 2026-10-12 | 4.3 Medium | ||
| Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6. | ||||
| CVE-2026-105059 | 2 Royalnavneet, Wordpress-extensions | 2 Delete All Comments Of Wordpress, Delete All Comments Of Wordpress | 2026-10-12 | 6.5 Medium |
| Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1. | ||||
| CVE-2026-107869 | 2026-10-12 | 4.3 Medium | ||
| Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4. | ||||
| CVE-2026-107863 | 2026-10-12 | 5.3 Medium | ||
| Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7. | ||||
| CVE-2026-107791 | 2026-10-12 | 6.5 Medium | ||
| The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site. | ||||
| CVE-2026-107432 | 2026-10-12 | 5.4 Medium | ||
| Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1. | ||||