Lucene search
+L

75269 matches found

CVE
CVE
added yesterday9 views

CVE-2026-2346

CVE-2026-2346 affects Menulux Software’s Mobile App up to version 12.05.2026, with an IDOR authorization bypass via a user-controlled key. The CVSS v3.1 score is 9.8 (CRITICAL), from vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack with no privileges required and no ...

9.8CVSS5.4AI score
SaveExploits0References1
EUVD
EUVD
added yesterday10 views

EUVD-2026-52263

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

9.8CVSS5.4AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday4 views

CVE-2026-2346

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

9.8CVSS5.4AI score
SaveExploits0References2
NVD
NVD
added yesterday8 views

CVE-2026-28147

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

5.4CVSS0.0017EPSS
SaveExploits0References1
CVE
CVE
added yesterday13 views

CVE-2026-60011

CVE-2026-60011 affects Sharp and Toshiba Tec MFPs. The issue is improper authorization that could allow direct access to certain image data stored on the affected devices via a network request. According to the provided metrics, CVSSv3.1 base score is 5.3 (MEDIUM) with low confidentiality impact,...

6.9CVSS5.5AI score0.00231EPSS
SaveExploits0References5
EUVD
EUVD
added yesterday7 views

EUVD-2026-52249

Sharp and Toshiba Tec MFPs multifunction printers fail to properly authorize requests to directly access certain image data stored to the affected product...

6.9CVSS5.5AI score0.00231EPSS
SaveExploits0References5
EUVD
EUVD
added yesterday7 views

EUVD-2026-52227

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

5.4CVSS5.4AI score0.0017EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday32 views

CVE-2026-28147 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

5.4CVSS0.0017EPSS
SaveExploits0References1
NVD
NVD
added yesterday9 views

CVE-2026-18584

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...

5.4CVSS0.0023EPSS
SaveExploits0References5
EUVD
EUVD
added yesterday7 views

EUVD-2026-52179

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including privat...

4.3CVSS5.5AI score0.00132EPSS
SaveExploits0References1
EUVD
EUVD
added yesterday5 views

EUVD-2026-52172

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

5.4AI score0.00142EPSS
SaveExploits0References1
CVE
CVE
added yesterday7 views

CVE-2026-16057

The Contest Gallery WordPress plugin,

5.6AI score0.00132EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday6 views

CVE-2026-18584

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...

5.4CVSS5.5AI score0.0023EPSS
SaveExploits0References6Affected Software6
EUVD
EUVD
added yesterday6 views

EUVD-2026-52153

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...

5.4CVSS5.5AI score0.0023EPSS
SaveExploits0References5
CVE
CVE
added yesterday12 views

CVE-2026-18584

GL.iNet: Affects E5800/E750/X2000/X3000/XE3000/XE300 devices; eSIM LPA API v1, file /sdk/v1, improper authorization due to manipulation of a function. Attack possible only from local network; vendor confirmation exists. No patch/workaround details provided in the documents.

5.4CVSS5.5AI score0.0023EPSS
SaveExploits0References5
Cvelist
Cvelist
added yesterday35 views

CVE-2026-18584 GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...

5.4CVSS0.0023EPSS
SaveExploits0References5
Nuclei
Nuclei
added yesterday80 views

WordPress InfiniteWP <1.9.4.5 - Authorization Bypass

WordPress InfiniteWP plugin before 1.9.4.5 for WordPress contains an authorization bypass vulnerability via a missing authorization check in iwpmmbsetrequest in init.php. An attacker who knows the username of an administrator can log in, thereby making it possible to obtain sensitive information,...

9.8CVSS7.7AI score0.88049EPSS
SaveExploits2References5
Nuclei
Nuclei
added yesterday77 views

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

8.1CVSS7.6AI score0.08589EPSS
SaveExploits1References5
Nuclei
Nuclei
added yesterday27 views

ProjectSend <= r1605 - Improper Authorization

An improper authorization check was identified within ProjectSend version r1605 that allows an attacker to perform sensitive actions such as enabling user registration and auto validation, or adding new entries in the whitelist of allowed extensions for uploaded files. Ultimately, this allows to...

9.8CVSS8.5AI score0.91559EPSS
SaveExploits4References3
Nuclei
Nuclei
added yesterday53 views

Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization

Atlasssian Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 is susceptible to incorrect authorization. The ManageFilters.jspa resource allows a remote attacker to enumerate usernames via an incorrect authorization check, thus possibly obtaining sensitive information, modifyi...

5.3CVSS6.2AI score0.12719EPSS
SaveExploits0References2
Rows per page
Query Builder