CVE-2025-39560 WordPress Live Forms plugin <= 4.8.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through = 4.8.4...

CVE-2025-39571 WordPress WowStore <= 4.2.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WPXPO WowStore allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WowStore: from n/a through 4.2.4...

PT-2025-16622 · Unknown · Woocommerce Product Table Lite

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Table Lite versions 3.9.5 and earlier Description: The issue is related to a Missing Authorization vulnerability in WC Product Table, which allows exploiting incorrectly configured access control security levels...

CVE-2025-30215 NATS-Server Fails to Authorize Certain Jetstream Admin APIs

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially expose...

CVE-2025-32929 WordPress Barcode Generator for WooCommerce plugin <= 2.0.4 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in Dmitry V. CEO of "UKR Solution" Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Barcode Generator for WooCommerce: from n/a through ...

PT-2025-16318 · Jettricks · Jettricks

Name of the Vulnerable Software and Affected Versions: JetTricks versions 1.5.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in JetTricks, which allows accessing functionality not properly constrained by ACLs. Recommendations: For JetTricks versions 1.5.1...

CVE-2025-23389 Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login

A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3...

CVE-2025-31041

Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through = 1.0.4...

CVE-2025-2408 Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information...

CVE-2025-32243

CVE-2025-32243 : Missing Authorization in WordPress Internal Link Optimiser (internal-link-finder). Connected data ties this to WordPress Internal Link Optimiser (plugin) with vulnerability class Missing Authorization to Unauthenticated Settings Update, affecting versions up to 5.1.2. The CVE ent...

CVE-2025-32260 WordPress DethemeKit For Elementor plugin <= 2.1.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in Detheme DethemeKit For Elementor. This issue affects DethemeKit For Elementor: from n/a through 2.1.10...

CVE-2025-32236 WordPress Woocommerce Products Reorder Drag Drop Multiple Sort plugin <= 1.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Vagonic Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic vagonic-sortable.This issue affects Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic: from n/a through = 1.9...

CVE-2025-32212 WordPress Specia Companion plugin <= 6.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Specia Theme Specia Companion specia-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Specia Companion: from n/a through = 6.3...

CVE-2025-32210 WordPress CM Registration and Invitation Codes plugin <= 2.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in CreativeMindsSolutions CM Registration and Invitation Codes cm-invitation-codes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Registration and Invitation Codes: from n/a through = 2.5.6...

PT-2025-16882 · Tp Link · Tp-Link M7200

Name of the Vulnerable Software and Affected Versions: TP-Link M7200 4G LTE Mobile Wi-Fi Router version 1.0.7 Build 180127 Rel.55998n Description: A SQL Injection issue exists, allowing an unauthenticated attacker to inject malicious SQL statements via the username and password fields. This issue...

CVE-2025-26888

CVE-2025-26888 is a Missing Authorization vulnerability in WooCommerce Multilingual & Multicurrency with WPML (affected: WooCommerce Multilingual & Multicurrency

PT-2025-15676

Name of the Vulnerable Software and Affected Versions: Mdecservice versions prior to SMR Apr-2025 Release 1 Description: The issue is related to improper access control, allowing local attackers to access arbitrary files with system privilege. Recommendations: For versions prior to SMR Apr-2025...

CVE-2025-20945

Improper access control in Galaxy Watch prior to SMR Apr-2025 Release 1 allows local attackers to access sensitive information of Galaxy watch...

CVE-2025-20945

CVE-2025-20945 concerns an improper access control in the Samsung Galaxy Watch. The issue affects Galaxy Watch versions prior to SMR Apr-2025 Release 1, enabling local attackers to access sensitive information stored on the device. The available connected sources confirm a local-attack vector and...

CVE-2025-20938

Summary: CVE-2025-20938 affects SamsungContacts. The issue is an improper access control that lets local attackers access protected data. Affected are SamsungContacts versions prior to SMR Apr-2025 Release 1. The vendor indicates remediation via a security update; users should apply SMR Apr-2025 ...