12932 matches found
EUVD-2026-37588
Author Broken Access Control in W3 Total Cache = 2.9.1 versions...
EUVD-2026-37665
Unauthenticated Broken Access Control in MetForm Pro = 3.9.1 versions...
EUVD-2026-37664
Subscriber Broken Access Control in MetForm Pro = 3.9.1 versions...
CVE-2026-55197
Hermes WebUI before 0.51.443 has a broken access control weakness in the /api/session endpoint. Authenticated users can bypass profile boundaries and query session IDs from other profiles via GET /api/session?session_id=&messages=1 to retrieve unauthorized transcripts and metadata. This affects t...
CVE-2026-55197 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET...
WordPress Gutenverse Companion plugin <= 2.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by mxym in WordPress Plugin Gutenverse Companion versions = 2.5.0...
CVE-2026-54810
The CVE-2026-54810 entry concerns the WordPress plugin Nexi XPay (≤ 8.3.1). The vulnerability is described as a Missing Authorization/ Broken Access Control issue caused by incorrectly configured access controls, affecting Nexi XPay on versions from n/a up to 8.3.1. Public metrics indicate a HIGH...
CVE-2026-54810 WordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nexi XPay: from n/a through 8.3.1...
WordPress Five Star Restaurant Reservations plugin <= 2.7.19 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Vincent Sevkli in WordPress Plugin Five Star Restaurant Reservations versions = 2.7.19...
CVE-2026-54415
CVE-2026-54415 is a broken access control issue in Azuriom CMS before 1.2.11. An authenticated user with the admin.access permission can abuse server-management routes to create AzLink server tokens and take over non-admin user accounts by changing passwords and emails. The vulnerability exists i...
WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by HaiND in WordPress Plugin Motors versions = 1.4.109...
CVE-2025-69189 WordPress JobBank plugin <= 1.2.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n/a through 1.2.3...
CVE-2026-49072
Unauthenticated Broken Access Control in WooCommerce Anti-Fraud = 7.2.6 versions...
CVE-2026-49057
Unauthenticated Broken Access Control in JobSearch = 3.2.7 versions...
CVE-2026-45436
Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...
CVE-2026-40726
Unauthenticated Broken Access Control in User Registration Stripe = 1.3.14 versions...
CVE-2026-39595
Author Broken Access Control in W3 Total Cache = 2.9.1 versions...
CVE-2026-24611
Unauthenticated Broken Access Control in MetForm Pro = 3.9.1 versions...