117961 matches found
CVE-2026-105888 WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1...
CVE-2026-105886
The BdThemes Ultimate Post Kit WordPress plugin (versions up to and including 4.5.5 ) is vulnerable to a Missing Authorization vulnerability (CWE-862). This flaw allows for the exploitation of incorrectly configured access control security levels . The vulnerability results in a medium severity r...
EUVD-2026-94943
Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through 4.5.5...
EUVD-2026-94931
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0...
CVE-2026-105878
The YITH WooCommerce Product Bundles WordPress plugin (versions
EUVD-2026-94928
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0...
CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...
CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...
CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...
CVE-2026-103649
Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...
CVE-2026-103649
Linux builds of Progressive Robot hMailServer versions 6.3.0 through 6.3.5 are vulnerable to a denial of service (DoS) due to missing network timeouts. The root cause is that the server sets socket timeouts in a Windows-specific format which Linux rejects, causing HTTPS clients to read without a ...
CVE-2026-104660 Missing Authorization in hMailServer
Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...
CVE-2026-104660 Missing Authorization in hMailServer
Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...
CVE-2026-104660
Progressive Robot hMailServer versions 6.0.0 through 6.3.5 (Windows) are vulnerable to a missing authorization flaw in its COM objects. The service registers COM classes without DCOM access or launch permissions and fails to use a security descriptor during CoInitializeSecurity, allowing local in...
CVE-2026-71183
An authorization vulnerability in Apache DolphinScheduler (versions before 3.4.3 ) allows authenticated users to access data sources they are not authorized to view. The /unauth-datasource and /authed-datasource endpoints fail to enforce proper access controls, potentially leaking sensitive conne...
CVE-2023-5648
In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more...
Missing Authorization
Payload CMS is vulnerable to Missing Authorization. The vulnerability is due to insufficient tenant-level authorization checks during record creation in @payloadcms/plugin-multi-tenant, which allows an authenticated user restricted to one tenant to create records in another tenant, bypassing tena...
CVE-2023-5648
In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more...
CVE-2026-107450
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations crates/graphql/src/mutation/smartlists.rs depend only on the shared AccessSmartList permission and resolve the target list at Reader access lacking a creator check. Any authenticated user with that permission can...
