199811 matches found
CVE-2025-15689
Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...
CVE-2025-62299
HCL IntelliOps Event Management (IEM) has a least-privilege violation allowing a privileged (PR:H) network attacker to access resources beyond their original privileges, with HIGH confidentiality impact. CVSS 6.6 MEDIUM; no exploitation details or fix version provided in the documents.
EUVD-2025-210753
HCL IntelliOps Event Management IEM is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges...
EUVD-2025-210750
HCL IntelliOps Event Management IEM is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing...
EUVD-2026-63320
Unauthenticated Broken Access Control in Koji = 2.2.1 versions...
EUVD-2026-63319
Unauthenticated Broken Access Control in EPROLO Dropshipping = 2.4.2 versions...
CVE-2026-74018
CVE-2026-74018 is an Arbitrary File Upload vulnerability in the WordPress Theme Warehouse Cargo (versions ≤ 2.6.9 ). The vulnerability is accessible to users with Subscriber privileges and carries a CVSS 3.1 score of 9.9 (Critical) , with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicatin...
CVE-2026-74016
The WordPress Smart Cleaning theme (≤4.8.6) allows any logged-in subscriber to upload arbitrary files, enabling remote code execution. Patchstack reports this as critical (CVSS 9.9) with a fix available in newer theme versions; upgrading the theme is the primary mitigation. No in-the-wild exploit...
CVE-2026-74013
eShipper Commerce WordPress plugin (versions
CVE-2026-74001
User Registration & Membership Pro is a WordPress plugin affected by an unauthenticated broken authentication vulnerability in versions ≤ 5.4.5 , enabling account takeover without any prior credentials. The flaw was discovered by 0xd4rk5id3 and carries a CVSS 3.1 score of 9.8 (CRITICAL) with a ne...
CVE-2026-73998
The WordPress WP w3all phpBB plugin (≤ 3.0.5) has a SQL injection vulnerability exploitable by authenticated subscribers with network access; no patch version or in-the-wild exploitation details are provided in the documents.
CVE-2026-73992
The WordPress Query Wrangler plugin (versions ≤ 1.5.57) allows authenticated subscribers to execute arbitrary code remotely, yielding full server compromise (CVSS 9.9 Critical, network-exploitable with low complexity). No in-the-wild exploitation or patch version is documented in the provided sou...
EUVD-2026-63311
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
CVE-2026-66682
CVE-2026-66682 is an unauthenticated privilege escalation vulnerability in the Abandoned Cart Pro for WooCommerce WordPress plugin, affecting versions
EUVD-2026-63307
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...
CVE-2026-66682 WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...
CVE-2026-66677 WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability
Subscriber Broken Authentication in Leyka = 3.32.3 versions...
CVE-2026-66677
CVE-2026-66677 is a Broken Authentication vulnerability in the WordPress plugin Leyka affecting versions
CVE-2026-66647
CVE-2026-66647 is a Broken Access Control vulnerability in the WordPress Homlisti theme , affecting versions 3.1.2 and below . The flaw allows a user with Subscriber privileges to perform actions beyond their intended access level, resulting in a high integrity impact (CVSS 3.1 score: 6.5 MEDIUM ...