266405 matches found
CVE-2026-112328 Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the addnewmoduleterm AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted courseid, since the handler validates only...
CVE-2026-112328 Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the addnewmoduleterm AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted courseid, since the handler validates only...
CVE-2026-112222
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744...
CVE-2026-111935
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...
CVE-2026-110902
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1...
EUVD-2026-104316
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...
WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Alpaslan Fatih Sözer in WordPress Plugin BjornTech Swish for WooCommerce versions = 3.7.8...
EUVD-2026-104324
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744...
CVE-2026-112222
The WordPress Surfer plugin (versions
CVE-2026-112222 WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744...
WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mor Golan in WordPress Plugin Surfer versions = 1.8.0.744...
EUVD-2026-104326
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1...
CLSA-2025-1746479711 kernel-uek: Fix of 225 CVEs
sctp: sysctl: authenable: avoid using current-nsproxy - sctp: sysctl: cookiehmacalg: avoid using current-nsproxy CVE-2025-21640 - bpf: Use preemptcount directly in bpfsendsignalcommon - Revert "sctp: sysctl: cookiehmacalg: avoid using current-nsproxy" - jfs: fix slab-out-of-bounds read in eaget -...
CVE-2026-111836
Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0...
CVE-2026-111831
Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15...
CVE-2026-111839
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7...
CVE-2026-111845
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0...
CVE-2026-110363
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10...
CVE-2026-111845
The YITH WooCommerce Product Bundles plugin for WordPress (versions up to and including 2.29.0 ) is affected by a Missing Authorization vulnerability. This flaw allows for Exploiting Incorrectly Configured Access Control Security Levels , as the plugin fails to properly enforce authorization chec...
CVE-2026-111845 WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0...