19902 matches found
CVE-2026-81796
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3...
CVE-2026-81799
Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce = 4.6.4 versions...
CVE-2026-81794
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...
CVE-2026-81793
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9...
CVE-2026-81786
Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...
CVE-2026-81788
Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...
CVE-2026-81787
Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...
CVE-2026-81785
Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...
CVE-2026-81783
Subscriber Broken Authentication in MailMunch – Grow your Email List = 3.2.5 versions...
CVE-2026-78536
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...
EUVD-2026-75178
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint...
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...
Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
Summary The chat-completions endpoint reads a folder id out of the request body and saves the newly created chat into that folder without checking that the caller is allowed to write there. Any authenticated user who knows a folder's id can put a chat of their own into another user's folder,...
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
Summary External knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for othe...
GHSA-2724-6CPJ-GF3V Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
Summary External knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for othe...
CVE-2026-84821 WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...
CVE-2026-84821 WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...
CVE-2026-84821
CVE-2026-84821 affects the WP Fast Total Search WordPress plugin in versions