Lucene search
+L

22667 matches found

CVE
CVE
added 2026/08/05 7:57 p.m.60 views

CVE-2026-70618

Spacebar Server (before commit 51da17c) contains a missing authorization vulnerability in the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint. The unprotected route handler lacks permission checks present in sibling endpoints, allowing any authenticated user with a valid bearer token a...

5.3CVSS5.5AI score0.00193EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/05 7:53 p.m.36 views

CVE-2026-70617 Spacebar Server Missing Authorization via Group DM Recipient Endpoint

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the...

8.6CVSS0.00231EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/05 7:53 p.m.25 views

CVE-2026-70617 Spacebar Server Missing Authorization via Group DM Recipient Endpoint

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the...

8.6CVSS5.6AI score
SaveExploits0References6
OSV
OSV
added 2026/08/05 3:11 p.m.7 views

CVE-2026-50749 Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions

Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to...

6.5CVSS5.5AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/05 3:11 p.m.37 views

CVE-2026-50749 Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions

Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to...

0.00305EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/08/05 3:11 p.m.9 views

CVE-2026-50749 Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions

Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to...

5.6AI score0.00305EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/05 3:11 p.m.16 views

EUVD-2026-53400

Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to...

5.6AI score0.00305EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/05 1:26 p.m.33 views

CVE-2026-7456 Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

6.5CVSS0.00239EPSS
SaveExploits0References7
CVE
CVE
added 2026/08/05 1:26 p.m.60 views

CVE-2026-7456

The Udimi Tools plugin for WordPress (versions

6.5CVSS5.3AI score0.00239EPSS
SaveExploits0References7
NVD
NVD
added 2026/08/05 1:24 p.m.9 views

CVE-2026-71262

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

9.8CVSS0.0035EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2026/08/05 1:03 p.m.9 views

WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by kai63001 in WordPress Plugin Dokan versions = 5.0.2...

8.8CVSS5.2AI score0.00358EPSS
SaveExploits0References1Affected Software1
Vulnrichment
Vulnrichment
added 2026/08/05 12:26 p.m.8 views

CVE-2026-71262 IoTSharp BlobStorageController Missing Authentication and Path Traversal

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

9.8CVSS5.3AI score0.0035EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/05 12:26 p.m.63 views

CVE-2026-71262

IoTSharp’s BlobStorageController is missing authorization and lacks a global authorization policy, making Upload/Download/List/Modify/Delete endpoints accessible without authentication. The endpoints pass path/filename parameters to blob storage without sanitization, enabling path traversal to wr...

9.8CVSS5.3AI score0.0035EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/05 10:57 a.m.9 views

EUVD-2026-53321

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload...

9.8CVSS5.8AI score0.00402EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2026/08/05 9:27 a.m.9 views

WordPress WPFormify – Stripe Payments with Form and Checkout plugin <= 1.1.1 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Legion Hunter in WordPress Plugin WPFormify – Stripe Payments with Form and Checkout versions = 1.1.1...

8.2CVSS5.5AI score0.00616EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2026/08/05 9:11 a.m.10 views

WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...

7.5CVSS5.5AI score0.00367EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 2026/08/05 8:59 a.m.10 views

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability discovered by Riski Gana Prasetya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.8...

9.1CVSS5.5AI score0.00456EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/05 7:39 a.m.46 views

CVE-2026-4431 Easy Post Submission <= 2.3.0 - Missing Authorization

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...

9.1CVSS0.00334EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/08/05 6:58 a.m.9 views

CVE-2026-54418 Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate unlike other RPC-exposed methods in the sa...

8.1CVSS5.3AI score0.00248EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/05 6:58 a.m.45 views

CVE-2026-54418 Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate unlike other RPC-exposed methods in the sa...

8.1CVSS0.00248EPSS
SaveExploits0References1
Rows per page
Query Builder