24467 matches found
CVE-2026-87896
CVE-2026-87896 affects the Rox Appointment Booking WordPress plugin in versions prior to 1.2.8 . The vulnerability stems from a missing authorization check on a REST endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read sensitive staff data including emai...
EUVD-2026-80210
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
EUVD-2026-80193
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...
CVE-2026-74926
CVE-2026-74926 affects the MultiVendorX WordPress plugin in versions 5.0.0 through 5.0.15 . The root cause is a missing ownership verification check in the plugin's stores REST API endpoint , which allows any authenticated user with at least the Subscriber role to overwrite arbitrary store detail...
CVE-2026-11984 Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...
CVE-2026-11984
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...
CVE-2026-91739
A flaw was found in the Transactions Platform component of Google Chrome. A remote attacker, after compromising the renderer process, could exploit a missing authorization vulnerability. This could allow the attacker to spoof user interface UI elements by crafting a malicious HTML page, potential...
CVE-2026-91732
A missing authorization flaw was found in the AppManifest component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511062248...
CVE-2026-91713
A flaw was found in the Browser component of Google Chrome. A remote attacker, after compromising the renderer process, could exploit missing authorization to spoof user interface UI elements. This could lead to a user being deceived by malicious UI, potentially enabling further attacks...
CVE-2026-91717
A flaw was found in Google Chrome on Android. This missing authorization vulnerability allows a local attacker, through a co-installed application, to obtain sensitive information. This could lead to unauthorized access to user data...
CVE-2026-82567
mySCADA myPRO Manager exposes an unauthenticated HTTP endpoint in its notification gateway that accepts a phone number and message to send SMS via a connected GSM modem. Because no credentials are required, any attacker with adjacent network access can trigger arbitrary SMS messages through the d...
CVE-2026-82567 mySCADA myPRO Manager Missing Authorization
The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...
CVE-2026-73807
mySCADA myPRO Manager has a missing authorization vulnerability in its command API , which fails to properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API can reach privileged management functions, rated CVSS 3.1 9.8 (Critical...
CVE-2026-73807 mySCADA myPRO Manager Missing Authorization
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...
CVE-2026-91739
Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-91732
Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-91717
Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...
CVE-2026-91713
Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...
DEBIAN-CVE-2026-91713
Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...