PT-2025-30068 · Microsoft · Azure Machine Learning

Name of the Vulnerable Software and Affected Versions: Azure Machine Learning affected versions not specified Description: Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. Recommendations: At the moment, there is no information...

XWiki 15.3-rc-1 < 15.10.14, 16.0.0-rc-1 < 16.4.6, 16.5.0-rc-1 < 16.10.0 Missing Authorization Vulnerability (GHSA-f9c6-2f9p-82jj)

Xwiki is prone to a missing authorization vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

CVE-2025-30959 WordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product XML Feed Manager for WooCommerce: from n/a through = 2.9.2...

CVE-2025-49888 WordPress PW WooCommerce On Sale! plugin <= 1.39 - Broken Access Control Vulnerability

Missing Authorization vulnerability in pimwick PW WooCommerce On Sale! pw-woocommerce-on-sale allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PW WooCommerce On Sale!: from n/a through = 1.39...

CVE-2025-52804 WordPress Nuss theme <= 1.3.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in uxper Nuss allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Nuss: from n/a through 1.3.3...

CVE-2025-52804 WordPress Nuss theme <= 1.3.7.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in uxper Nuss nuss allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Nuss: from n/a through = 1.3.7.1...

CVE-2025-52804

CVE-2025-52804 concerns the WordPress Nuss theme (uxper Nuss) with versions

CVE-2025-48155 WordPress Residential Address Detection plugin <= 2.5.9 - Broken Access Control Vulnerability

Missing Authorization vulnerability in enituretechnology Residential Address Detection allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Residential Address Detection: from n/a through 2.5.9...

CVE-2025-48167 WordPress Chatbox Manager plugin <= 1.2.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in alexvtn Chatbox Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Chatbox Manager: from n/a through 1.2.5...

CVE-2025-54047

CVE-2025-54047 concerns the WordPress plugin Cost Calculator. The initial description identifies a missing authorization issue due to incorrectly configured access control levels, affecting versions up to and including 7.4. Connected sources corroborate a broken access control vulnerability for t...

CVE-2025-54037 WordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through = 1.3.4...

CVE-2025-53997 WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through = 4.0.4...

CVE-2025-53986 WordPress Hestia theme <= 3.2.10 - Broken Access Control Vulnerability

Missing Authorization vulnerability in themeisle Hestia hestia allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hestia: from n/a through = 3.2.10...

BIT-GITLAB-2025-4972 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionality...

BIT-GITLAB-2025-3396 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests...

PT-2025-29741 · Houzez · Houzez

Name of the Vulnerable Software and Affected Versions: Houzez versions prior to 4.0.5 Description: A missing authorization issue exists in Houzez, allowing exploitation of incorrectly configured access control security levels. Recommendations: Update Houzez to version 4.0.5 or later...

PT-2025-29759 · Blazethemes · News Kit Elementor Addons

Name of the Vulnerable Software and Affected Versions: blazethemes News Kit Elementor Addons versions through 1.3.4 Description: The software contains a missing authorization issue, allowing exploitation of incorrectly configured access control security levels. Recommendations: Update blazethemes...

Oracle Fusion Middleware 授权问题漏洞

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. WebLogic Server is one of the application server components for cloud and traditional...

CyberArk Conjur 授权问题漏洞

CyberArk Conjur is an open source key management software from CyberArk. An authorization issue vulnerability exists in CyberArk Conjur that stems from an authentication request redirection that could lead to elevation of privilege...

CVE-2025-6168 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests...