CVE-2026-4106

CVE-2026-4106: WordPress HT Mega Unauthenticated PII Disclosure Exploit A robust, multi-threaded Proof of Concept PoC exploit for CVE-2026-4106 , targeting the HT Mega - Absolute Addons for Elementor plugin for WordPress versions 3.0.7. Vulnerability Overview The HT Mega plugin registers several...

EUVD-2026-110641

A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August...

CVE-2026-85299

A Missing Authorization vulnerability exists in the disks.createSnapshot and regionDisks.createSnapshot APIs within Google Compute Engine (versions prior to 2026-08-31). This flaw allows an authenticated attacker to exfiltrate cross-project disk data on the Google Cloud Platform. The vulnerabilit...

CVE-2026-85299 Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration

A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August...

cve-2025-66723

CVE-2025-66723: inMusic Brands Engine DJ =3.0.0 through =3.0.0, 4.3.4, on all platforms macOS, Windows. Specifically tested versions found affected/vulnerable, macOS and Windows: 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.3.0, 3.4.0, 4.0.0, 4.0.1, 4.1.0, 4.2.0, 4.2.1, 4.3.0 Specifically tested versions...

CVE-2024-48955_Overview

CVE-2024-48955Overview Description: Netadmin 4 IAM with access control flaws. Affected version: V4.030319 NetAdmin system returns data with functionalities in the endpoint that "builds" the functionality menus; the response of this call is not encrypted, and as the system does not validate sessio...

By-Poloss..-..CVE-2026-11912

CVE-2026-11912: Simple File List eeListSettings'AllowFrontManage' != 'YES' return;...

CVE-2024-11848

CVE-2024-11848 NitroPack = 1.17.0 - Missing Authorization to Authenticated Subscriber+ Limited Options Update Description The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropackdismissnoticeforever' AJAX action in a...

WordPress Advanced Custom Fields: Extended plugin <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability discovered by normaandersonfrank in WordPress Plugin ACF Extended versions = 0.9.2.6...

Craftcms-PoC-CVE-2026-31266

CVE-2026-31266 - Craft CMS Missing Authorization CVE Information Field| Value ---|--- CVE ID| CVE-2026-31266 Vendor| Pixel & Tonic Product| Craft CMS Affected Versions| self::ALLOWANONYMOUSLIVE | self::ALLOWANONYMOUSOFFLINE, ; Proof of Concept With allowAdminChanges=false curl -X POST...

Cve-2026-39676

Cve-2026-39676 Wordpress Version: Download Manager 3.3.5.2 Title: Missing Authorization - Unauthenticated IDOR Exploit...

Chromium CVE-2026-106406: Missing authorization in Mobile

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-106387: Missing authorization in Mobile

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-106367: Missing authorization in Mobile

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-35273

🚨 CVE-2026-35273 - Oracle PeopleSoft PeopleTools Unauthenticated Remote Code Execution ⚠️ Critical Unauthenticated RCE in Oracle PeopleSoft PeopleTools A vulnerability affecting Oracle PeopleSoft Enterprise PeopleTools that allows remote attackers to compromise vulnerable systems without...

CVE-2024-7135

CVE-2024-7135 Tainacan = 0.21.7 - Missing Authorization to Authenticated Subscriber+ Arbitrary File Read Description The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including,...

CVE-2024-9821

CVE-2024-9821 Bot for Telegram on WooCommerce = 1.2.4 - Authenticated Subscriber+ Telegram Bot Token Disclosure to Authentication Bypass Description The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on th...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection Broken Access Control Proof of concept for a missing-authorization flaw in MISP's bulk deletion flows for Event Reports and Sharing Groups. The deleteSelection handlers authorize each selected item with a callback that ignores the item and returns the caller'...

CVE-2024-52429

CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...

CVE-2025-14172-Nuclei-Template

📄 Nuclei Template for CVE-2025-14172 🚀 Overview This repository features a Nuclei template specifically designed to detect a Missing Authorization Vulnerability CVE-2025-14172 in the WP Page Permalink Extension WordPress plugin. This issue allows authenticated attackers to remotely flush the site...