35798 matches found
VulnCheck KEV: CVE-2023-32798
Missing Authorization vulnerability in 10up Simple Page Ordering allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Page Ordering: from n/a through 2.5.0...
CVE-2026-110208: Missing Authorization
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...
PT-2026-112217
šØ CVE-2026-70098 Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. š@cveNotify...
PT-2026-111840
Name of the Vulnerable Software and Affected Versions youlai-boot versions prior to 2.21.2 Description A missing authorization issue allows any authenticated user to enable or disable accounts. This occurs because the updateUserStatus handler lacks a @PreAuthorize check, which is a security...
CVE-2026-102861: Missing Authorization
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-109890: Missing Authorization
Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110...
CVE-2026-109898: Missing Authorization
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25...
PT-2026-111557
Name of the Vulnerable Software and Affected Versions Froxlor versions 0.10.0 through 2.3.13 Description Missing authorization allows reseller accounts to access MySQL server and cronjob configurations intended only for full administrators. This is achieved by using API read commands through the...
PT-2026-112897
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network. Recommendations At the moment, there is no informatio...
CVE-2026-110100: Missing Authorization
Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse getheaders an...
CVE-2026-110215: Missing Authorization
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/roleId/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role,...
CVE-2026-109703: Missing Authorization
Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1...
Microsoft VS Code: CVE-2026-70098: Visual Studio Code Remote Code Execution Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-108492: Missing Authorization
Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3...
PT-2026-111715
Name of the Vulnerable Software and Affected Versions Makunet maku-boot versions 4.3.0 through 5.0.0 Description Authenticated users can access mail and SMS configurations due to missing authorization checks. By calling the endpoints '/sys/mail/config/list' and '/sys/sms/config/list', attackers c...
CVE-2026-110230: Missing Authorization
XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...
CVE-2026-110105: Missing Authorization
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/reportId, /admin/tags/remove-unuse...
PT-2026-111710
Name of the Vulnerable Software and Affected Versions WorkFlow-Engine versions prior to 9.6.12 Description Authenticated users can complete or reassign workflow tasks belonging to other users due to missing authorization. Low-privileged attackers can exploit this by providing a known taskId to th...
CVE-2026-108496: Missing Authorization
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.23...
CVE-2026-106598: Missing Authorization
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8...