78117 matches found
CVE-2026-54201
The CVE-2026-54201 entry concerns Tobit Laboratories AG TeamDavid’s Webbox. The issue: missing authentication/authorization when serving log files, enabling attackers to obtain sensitive error information or internal application details. Affected component: TeamDavid through Rollout 524. The vuln...
CVE-2026-16262
The CVE affects the Estatik Real Estate Plugin for WordPress (versions before 4.3.3). The vulnerability arises because the plugin does not bind the OAuth social login flow to the initiating user session, enabling an unauthenticated attacker to perform a login CSRF and have the victim’s subsequent...
CVE-2026-16262 Estatik < 4.3.3 - Login CSRF
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...
CVE-2026-16041
The CVE-2026-16041 entry concerns the MStore API WordPress plugin prior to version 4.21.0. The REST endpoint used for creating product reviews lacks authorization and purchase-ownership checks, allowing an unauthenticated attacker to submit WooCommerce product reviews with arbitrary reviewer name...
CVE-2026-11907
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2026-14365
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
EUVD-2026-54366
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2026-11907 Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2026-11907
CVE-2026-11907 concerns the WordPress Stream plugin (
CVE-2026-14365
The TrueBooker – Appointment Booking and Scheduler System WordPress plugin is affected up to version 1.2.3. The root cause is an authorization bypass due to improper verification of a user’s rights, allowing unauthenticated attackers to change the passwords of arbitrary accounts (including admini...
CVE-2026-14365 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
EUVD-2026-54364
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
[SECURITY] Fedora 43 Update: freeipa-4.13.2-1.fc43
IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...
EUVD-2026-54322
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54314
Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54321
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54171
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...
EUVD-2026-54207
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument ID results in authorization bypass. The attack can be launched remotely...
EUVD-2026-54220
A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file viewstudents.php. Such manipulation of the argument classgroup leads to authorization bypass. The attack may be launched remotely...