Export limit exceeded: 16528 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16528 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120730 | 1 Nerves-hub | 1 Nerves Hub Web | 2026-11-10 | N/A |
| Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one. A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it. This issue affects nerves_hub: from 1.0.0 before 2.5.3. | ||||
| CVE-2026-10830 | 1 Wordpress-extensions | 1 Allcoach | 2026-11-10 | 8.8 High |
| The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site. | ||||
| CVE-2026-12271 | 1 Wordpress-extensions | 1 Tutor Lms | 2026-11-10 | 5.4 Medium |
| The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result. | ||||
| CVE-2026-12397 | 1 Wordpress-extensions | 1 Wp Job Portal | 2026-11-10 | 4.3 Medium |
| The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level (self-registerable) account to read other employers' private account email addresses by enumerating job identifiers. | ||||
| CVE-2026-12510 | 1 Wordpress-extensions | 1 Ai Engine | 2026-11-10 | 5.9 Medium |
| The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled. | ||||
| CVE-2026-12906 | 1 Wordpress-extensions | 1 Rtmkit | 2026-11-10 | 2.7 Low |
| The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts. | ||||
| CVE-2026-12393 | 1 Wordpress-extensions | 1 Wps Bookings For Woocommerce | 2026-11-10 | 5.4 Medium |
| The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders. | ||||
| CVE-2026-14183 | 1 Wordpress-extensions | 1 Classified Listing | 2026-11-10 | 4.3 Medium |
| The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order. | ||||
| CVE-2026-14927 | 1 Wordpress-extensions | 1 Fluentcart | 2026-11-10 | 3.7 Low |
| The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billing and shipping postal addresses, and order details) across the store. | ||||
| CVE-2026-12697 | 1 Wordpress-extensions | 1 Wpforo Forum | 2026-11-10 | 5.4 Medium |
| The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user. | ||||
| CVE-2026-14197 | 1 Wordpress-extensions | 1 Fluent Support | 2026-11-10 | 3.8 Low |
| The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope. | ||||
| CVE-2026-103375 | 1 Wordpress-extensions | 1 Antom Payments | 2026-11-10 | 5.3 Medium |
| The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its secret key, to unauthenticated visitors, allowing attackers to view any customer's order details, including name, address, phone number and email. | ||||
| CVE-2026-121759 | 1 Wordpress-extensions | 1 Fusion Page Builder | 2026-11-10 | 4.9 Medium |
| The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash is disabled. | ||||
| CVE-2026-106466 | 1 Wordpress-extensions | 1 Jwt Auth | 2026-11-10 | 7.5 High |
| The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator. | ||||
| CVE-2026-119759 | 1 Trailbaseio | 1 Trailbase | 2026-11-10 | 8.1 High |
| TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers can reference another user's or table's file id in a record they own to read the victim's file bytes through their own record, or trigger permanent deletion of the victim's file by deleting or nulling their own record, while also using a $like filter on the file column to brute-force recover stripped ids character by character. | ||||
| CVE-2026-125365 | 1 Harung1993 | 1 Dollardollar | 2026-11-10 | 6.5 Medium |
| DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer. | ||||
| CVE-2026-125369 | 1 Fsinfuhh | 1 Bitpoll | 2026-11-10 | 5.3 Medium |
| Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls. | ||||
| CVE-2026-125373 | 1 Ietf-tools | 1 Datatracker | 2026-11-10 | 5.4 Medium |
| IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses. | ||||
| CVE-2026-110129 | 1 Fushengqian | 1 Fuintcatering | 2026-11-10 | 6.5 Medium |
| fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details. | ||||
| CVE-2026-58280 | 1 Microsoft | 5 .net, .net Framework, Microsoft Visual Studio 2022 Version 17.14 and 2 more | 2026-11-10 | 7.5 High |
| Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. | ||||