Lucene search
+L

168920 matches found

OSV
OSV
added 2026/09/04 8:47 a.m.5 views

BIT-JOOMLA-2026-73371 Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260808 - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items...

5.1CVSS5.3AI score0.00208EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/09/04 8:45 a.m.36 views

CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

5.4CVSS0.00185EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/04 8:45 a.m.8 views

CVE-2026-27432

The WP Rentals WordPress theme by sc Internet Vivoo is affected by an Authorization Bypass Through User-Controlled Key vulnerability (classified as an Insecure Direct Object Reference / IDOR ) in versions before 3.16.0 . The flaw allows exploitation of incorrectly configured access control securi...

5.4CVSS5.2AI score0.00185EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/04 8:45 a.m.6 views

EUVD-2026-70975

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

5.4CVSS5.2AI score0.00185EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/04 8:07 a.m.37 views

CVE-2026-85311 WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60...

5.3CVSS0.00176EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/04 8:07 a.m.5 views

EUVD-2026-70970

Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/04 8:07 a.m.10 views

CVE-2026-85311

CVE-2026-85311 is a Missing Authorization (Broken Access Control) vulnerability in the MarketKing WordPress plugin by Kings Plugins, affecting versions up to 2.1.60 . The flaw allows an unauthenticated remote attacker to exploit incorrectly configured access control security levels, resulting in ...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/04 8:06 a.m.6 views

WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin MarketKing versions = 2.1.60...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0Affected Software1
EUVD
EUVD
added 2026/09/04 8:02 a.m.5 views

EUVD-2026-70969

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/04 8:02 a.m.38 views

CVE-2026-32480 WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

5.3CVSS0.00176EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/04 8:02 a.m.7 views

CVE-2026-32480

CVE-2026-32480 affects the WCFM Membership WordPress plugin (by WC Lovers) in versions up to and including 2.11.11 . The vulnerability is a missing authorization (broken access control) flaw that allows exploitation of incorrectly configured access control security levels. The CVSS v3.1 score is ...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/04 7:59 a.m.6 views

WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mySebbe in WordPress Plugin WCFM Membership versions = 2.11.11...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0Affected Software1
Kitploit
Kitploit
added 2026/09/04 7:48 a.m.6 views

CVE-2026-67182-HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille-

Security Advisory: HTTP Request Smuggling Enables Front-End Access Control Bypass rouille Assigned CVE ID: CVE-2026-67182 Summary rouille::proxy::proxy and rouille::proxy::fullproxy copy client-supplied request header values into the upstream connection without checking them for control character...

7.5CVSS5.9AI score0.00415EPSS
SaveExploits1References1
NVD
NVD
added 2026/09/04 7:17 a.m.6 views

CVE-2026-80438

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

5.9CVSS0.0014EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/04 7:17 a.m.4 views

CVE-2026-84066

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

3.1CVSS0.00133EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/04 7:17 a.m.4 views

CVE-2026-19224

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

7.2CVSS0.0037EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/04 7:17 a.m.6 views

CVE-2026-16281

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

7.1CVSS0.00195EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/04 7:01 a.m.6 views

LogMeInPoCHandleDup

LogMeIn / GoTo LMIInfo.sys Handle Duplication Summary A race condition exists in the LMIInfo.sys driver provided by LogMeIn / GoTo RMM wherein an arbitrary handle can be duplicated from the SYSTEM process. The core issue stems from the lack of proper access control on the device object alongside...

6AI score
SaveExploits0
EUVD
EUVD
added 2026/09/04 6:00 a.m.6 views

EUVD-2026-70912

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

3.1CVSS5.2AI score0.00133EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/04 6:00 a.m.33 views

CVE-2026-84066 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

0.00133EPSS
SaveExploits0References1
Rows per page
Query Builder