19978 matches found
CVE-2026-84805
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...
CVE-2026-84801
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...
CVE-2026-84792
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...
CVE-2026-84772
Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...
CVE-2026-84760
Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce = 3.2.9 versions...
CVE-2026-82223
Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...
WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Jorgson in WordPress Plugin YITH Request a Quote for WooCommerce Premium versions 4.46.0...
CVE-2026-84217
CVE-2026-84217 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Classified Listing by Mamunur Rashid, affecting versions from unknown (n/a) through 6.1.1 . The flaw allows authenticated low-privilege users to access functionality not properly constrained by...
CVE-2026-84217 WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.3...
CVE-2026-84217 WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.3...
WordPress Classified Listing plugin <= 6.1.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Muhammad Bilal bilalmajid1 in WordPress Plugin Classified Listing versions = 6.1.2...
CVE-2026-84835 WordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: from n/a through 2.1.5...
CVE-2026-84835
CVE-2026-84835 is a Missing Authorization (Broken Access Control) vulnerability in the DimaFreund Rentsyst WordPress plugin, affecting versions through 2.1.2 . The flaw allows an unauthenticated, remote attacker to exploit incorrectly configured access control security levels, resulting in low co...
CVE-2026-84835 WordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: from n/a through 2.1.5...
WordPress Rentsyst plugin <= 2.1.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin Rentsyst versions = 2.1.3...
CVE-2026-84772
A Server-Side Request Forgery (SSRF) vulnerability was identified in the Broken Link Checker WordPress plugin, affecting versions ≤ 2.4.14 . The flaw is exploitable by users with Editor privileges, allowing them to forge server-side requests. The CVSS 3.1 score is 5.5 (Medium) with a changed scop...
EUVD-2026-69940
Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...
CVE-2026-84772 WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability
Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...