CWE-862 · Missing Authorization (page 14)
Page 14 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4683 | Medium | 6.5 | 2026-05-15 | The Smartcat Translator for WPML plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'routeData' R… |
CVE-2026-4094 | High | 8.1 | 2026-05-15 | The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the… |
CVE-2026-8547 | High | 7.5 | 2026-05-14 | Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-45371 | | 2026-05-14 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs. POS… | |
CVE-2026-45147 | Medium | 4.3 | 2026-05-14 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with model.CheckAuth only, omitting both mode… |
CVE-2026-44592 | Critical | 9.4 | 2026-05-14 | Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can re… |
CVE-2026-41315 | Critical | 9.8 | 2026-05-14 | mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack… |
CVE-2026-44482 | Critical | 9.6 | 2026-05-14 | soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payl… |
CVE-2026-6472 | Medium | 5.4 | 2026-05-14 | Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including ext… |
CVE-2026-4031 | High | 7.5 | 2026-05-14 | The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the pl… |
CVE-2026-4030 | High | 8.1 | 2026-05-14 | The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5… |
CVE-2026-4029 | High | 7.5 | 2026-05-14 | The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due t… |
CVE-2026-6512 | Critical | 9.1 | 2026-05-14 | The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not proper… |
CVE-2026-6145 | Medium | 5.3 | 2026-05-14 | The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5. This is due to the… |
CVE-2026-6510 | Critical | 9.8 | 2026-05-14 | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is du… |
CVE-2026-6506 | High | 8.8 | 2026-05-14 | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to the infusedwoo_gdpr_u… |
CVE-2026-8144 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-6883 | Low | 2.6 | 2026-05-14 | GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allo… |
CVE-2026-3829 | Medium | 5.4 | 2026-05-14 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2026-2900 | Low | 2.7 | 2026-05-14 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-… |
CVE-2026-7525 | Medium | 4.3 | 2026-05-14 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due… |
CVE-2026-44448 | Medium | 5.9 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization ch… |
CVE-2026-44442 | Critical | 9.9 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing… |
CVE-2026-28380 | Medium | 6.5 | 2026-05-13 | Any Editor could delete any snapshot, even if they have no access to read or write them. |
CVE-2026-0246 | High | 7.8 | 2026-05-13 | A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to… |
CVE-2026-4609 | High | 7.1 | 2026-05-13 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pm_i… |
CVE-2026-4607 | Medium | 4.3 | 2026-05-13 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.8… |
CVE-2026-3426 | Medium | 4.3 | 2026-05-13 | The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the save_widget() a… |
CVE-2026-2515 | Medium | 5.3 | 2026-05-13 | The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2026-7051 | Medium | 5.4 | 2026-05-13 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. Th… |
CVE-2025-14755 | Medium | 5.3 | 2026-05-13 | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all version… |
CVE-2026-5371 | High | 7.1 | 2026-05-12 | The MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnerable to unauthorized access and modifica… |
CVE-2026-44012 | | 2026-05-12 | Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its… | |
CVE-2026-44010 | | 2026-05-12 | Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Addre… | |
CVE-2026-5146 | Medium | 4.3 | 2026-05-12 | Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user no… |
CVE-2026-42541 | Medium | 4.3 | 2026-05-12 | Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions (which isn't th… |
CVE-2026-35438 | High | 8.3 | 2026-05-12 | Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-31245 | Medium | 5.3 | 2026-05-12 | The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticate… |
CVE-2026-31244 | Medium | 6.5 | 2026-05-12 | The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}). The endpoint allows… |
CVE-2026-31243 | Medium | 6.5 | 2026-05-12 | The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functionality accessible via the DELETE /memor… |
CVE-2026-31242 | Critical | 9.1 | 2026-05-12 | The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unau… |
CVE-2026-31241 | Medium | 6.5 | 2026-05-12 | The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint allows unauthentica… |
CVE-2026-26083 | Critical | 9.8 | 2026-05-12 | A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, F… |
CVE-2026-8407 | Medium | 4.3 | 2026-05-12 | Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secre… |
CVE-2026-25431 | Medium | 5.3 | 2026-05-12 | Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hustle: thr… |
CVE-2026-45212 | Medium | 5.3 | 2026-05-12 | Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-45210 | Medium | 5.4 | 2026-05-12 | Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-1934 | Medium | 4.3 | 2026-05-12 | The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Payment Bypass via insecure user meta update in all versions up to, and… |
CVE-2026-7050 | Medium | 4.3 | 2026-05-12 | The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly ver… |
CVE-2026-6709 | Medium | 4.3 | 2026-05-12 | The Coinbase Commerce for Contact Form 7 plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.1.2. This is due to a mi… |
CVE-2026-6708 | Medium | 5.3 | 2026-05-12 | The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3… |
CVE-2026-6663 | Medium | 4.8 | 2026-05-12 | The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to… |
CVE-2026-5693 | Medium | 5.3 | 2026-05-12 | The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validatio… |
CVE-2026-4301 | Medium | 4.3 | 2026-05-12 | The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1… |
CVE-2026-39432 | High | 8.2 | 2026-05-12 | Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics… |
CVE-2026-40134 | Medium | 4.3 | 2026-05-12 | Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function… |
CVE-2026-40133 | Medium | 6.3 | 2026-05-12 | Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition… |
CVE-2026-40132 | Medium | 5.4 | 2026-05-12 | Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access i… |
CVE-2026-43885 | | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php an… | |
CVE-2026-20696 | Medium | 5.5 | 2026-05-11 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data. |
CVE-2026-45001 | High | 7.1 | 2026-05-11 | OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect opera… |
CVE-2026-44994 | Medium | 5.3 | 2026-05-11 | OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to… |
CVE-2026-43639 | High | 8.0 | 2026-05-11 | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to thei… |
CVE-2026-43638 | Medium | 5.4 | 2026-05-11 | Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organi… |
CVE-2026-33359 | High | 7.5 | 2026-05-11 | In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authen… |
CVE-2026-33357 | High | 7.5 | 2026-05-11 | In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the int… |
CVE-2026-42613 | Critical | 9.4 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields… |
CVE-2026-32658 | High | 8.0 | 2026-05-11 | Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote access could potentia… |
CVE-2021-47932 | Critical | 9.8 | 2026-05-10 | WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitt… |
CVE-2026-8194 | Medium | 4.3 | 2026-05-09 | A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component… |
CVE-2026-42569 | Critical | 9.4 | 2026-05-09 | phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a lega… |
CVE-2025-15634 | Medium | 4.3 | 2026-05-09 | A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information v… |
CVE-2026-42461 | High | 7.5 | 2026-05-09 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.18.0, four GET endpoints under /api/templates* in Arca… |
CVE-2026-42297 | High | 8.3 | 2026-05-09 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, th… |
CVE-2026-42174 | Medium | 4.3 | 2026-05-09 | Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user upda… |
CVE-2026-42137 | Medium | 6.5 | 2026-05-09 | Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consisten… |
CVE-2026-42069 | Medium | 6.5 | 2026-05-09 | Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permission… |
CVE-2026-42051 | Medium | 4.3 | 2026-05-09 | Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authe… |
CVE-2026-6667 | Medium | 4.3 | 2026-05-09 | PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration conso… |
CVE-2026-44125 | | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated r… | |
CVE-2026-39816 | High | 8.8 | 2026-05-08 | The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1… |
CVE-2026-8077 | | 2026-05-08 | Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend lacks authorization controls, leaving s… | |
CVE-2026-41498 | Low | 3.3 | 2026-05-08 | Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit'… |
CVE-2026-27416 | Medium | 5.3 | 2026-05-07 | Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Pos… |
CVE-2026-25436 | Medium | 5.3 | 2026-05-07 | Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affe… |
CVE-2025-66105 | Medium | 5.3 | 2026-05-07 | Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-6214 | Medium | 6.5 | 2026-05-07 | The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_e… |
CVE-2026-41658 | Medium | 6.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations (del… |
CVE-2026-4807 | Medium | 6.5 | 2026-05-07 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.6.10.6. This is due to a flawed… |
CVE-2026-6222 | Medium | 5.3 | 2026-05-07 | The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the `processRequest()`… |
CVE-2026-43583 | Medium | 5.3 | 2026-05-06 | OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered q… |
CVE-2026-43580 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforc… |
CVE-2026-43579 | Medium | 6.5 | 2026-05-06 | OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permission… |
CVE-2026-43577 | Medium | 6.5 | 2026-05-06 | OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers… |
CVE-2026-43575 | Critical | 9.8 | 2026-05-06 | OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser… |
CVE-2026-20193 | Medium | 4.3 | 2026-05-06 | A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an authenticated, remote attacker with read-only Administrator privileges to g… |
CVE-2026-20189 | Medium | 4.3 | 2026-05-06 | A vulnerability in the log file download functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to download arbitrary l… |
CVE-2026-2306 | Medium | 4.3 | 2026-05-06 | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation due to missing authorization checks on th… |
CVE-2026-5753 | Medium | 6.5 | 2026-05-06 | The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due… |
CVE-2026-3208 | Medium | 5.3 | 2026-05-06 | The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_im… |