CWE-862 · Missing Authorization (page 17)
Page 17 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39614 | Medium | 5.4 | 2026-04-08 | Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-39612 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in kutethemes KuteShop kuteshop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-39610 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Pankaj Kumar WpXmas-Snow wpxmas-snow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-39609 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Wava.co Wava Payment wava-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-39608 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-39607 | Medium | 5.4 | 2026-04-08 | Missing Authorization vulnerability in Wpbens Filter Plus filter-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-39606 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Foysal Imran BizReview bizreview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-39605 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Obadiah Super Custom Login super-custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-39602 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-39592 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-39588 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in nmerii NM Gift Registry and Wishlist Lite nm-gift-registry-and-wishlist-lite allows Exploiting Incorrectly Configured Ac… |
CVE-2026-39585 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics… |
CVE-2026-39569 | Medium | 6.5 | 2026-04-08 | Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-39565 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-39563 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-39562 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-39561 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-39543 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-39535 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-39528 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-39520 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs… |
CVE-2026-39509 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-39506 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Jordy Meow AI Engine (Pro) ai-engine-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-39505 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Con… |
CVE-2026-39504 | Medium | 5.4 | 2026-04-08 | Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-39501 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-39488 | Medium | 6.5 | 2026-04-08 | Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Su… |
CVE-2026-39485 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in embedplus Youtube Embed Plus youtube-embed-plus allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-39477 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-39476 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-3480 | Medium | 6.5 | 2026-04-08 | The WP Blockade plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 0.9.14. The plugin registers an admin_post acti… |
CVE-2026-3477 | Medium | 5.3 | 2026-04-08 | The PZ Frontend Manager plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.6. The pzfm_user_request_action_cal… |
CVE-2026-4299 | Medium | 5.3 | 2026-04-08 | The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capabi… |
CVE-2026-4003 | Critical | 9.8 | 2026-04-08 | The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15. Th… |
CVE-2026-3646 | Medium | 5.3 | 2026-04-08 | The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up t… |
CVE-2026-2263 | Medium | 5.3 | 2026-04-08 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili… |
CVE-2026-4065 | Medium | 5.4 | 2026-04-07 | The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smar… |
CVE-2026-39401 | Medium | 5.4 | 2026-04-07 | Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in th… |
CVE-2026-39397 | Critical | 9.4 | 2026-04-07 | @delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registere… |
CVE-2026-39360 | Medium | 4.3 | 2026-04-07 | RustFS is a distributed object storage system built in Rust. Prior to alpha.90, RustFS contains a missing authorization check in the multipart copy path (Uploa… |
CVE-2026-39355 | Critical | 9.9 | 2026-04-07 | Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticate… |
CVE-2026-39351 | Critical | 9.1 | 2026-04-07 | Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit. |
CVE-2026-39348 | Medium | 4.3 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source omits authorization on job specification and vacanc… |
CVE-2026-22680 | Medium | 5.3 | 2026-04-07 | OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate… |
CVE-2026-35606 | High | 7.5 | 2026-04-07 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the r… |
CVE-2026-22683 | High | 8.8 | 2026-04-07 | Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity cr… |
CVE-2025-14944 | Medium | 5.3 | 2026-04-07 | The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capabili… |
CVE-2026-4292 | Low | 2.7 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allo… |
CVE-2026-4277 | Critical | 9.8 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submissi… |
CVE-2026-33866 | Medium | 4.3 | 2026-04-07 | MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a… |
CVE-2026-34903 | Medium | 5.4 | 2026-04-07 | Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Ext… |
CVE-2026-34899 | Medium | 5.3 | 2026-04-07 | Missing Authorization vulnerability in Eniture technology LTL Freight Quotes – Worldwide Express Edition allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-35448 | Low | 3.7 | 2026-04-06 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bi… |
CVE-2026-35182 | High | 8.8 | 2026-04-06 | Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The P… |
CVE-2026-35179 | Medium | 5.3 | 2026-04-06 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that act… |
CVE-2026-35175 | Medium | 6.5 | 2026-04-06 | Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install… |
CVE-2026-34976 | Critical | 10.0 | 2026-04-06 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (a… |
CVE-2024-14032 | High | 7.8 | 2026-04-06 | Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbit… |
CVE-2026-3524 | High | 8.8 | 2026-04-06 | Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated att… |
CVE-2026-5624 | Medium | 4.3 | 2026-04-06 | A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in… |
CVE-2026-5574 | Medium | 6.5 | 2026-04-05 | A security vulnerability has been detected in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Affected is the function deletefile of the component FsBrowseClean… |
CVE-2026-5572 | Medium | 4.3 | 2026-04-05 | A security flaw has been discovered in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. This affects an unknown function. Performing a manipulation results in cro… |
CVE-2026-3445 | High | 7.1 | 2026-04-04 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2026-2826 | Medium | 4.3 | 2026-04-04 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-3571 | Medium | 6.5 | 2026-04-04 | The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2026-34766 | Low | 3.3 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-be… |
CVE-2026-27833 | High | 7.5 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the… |
CVE-2026-35561 | High | 7.4 | 2026-04-03 | Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat a… |
CVE-2026-25742 | Medium | 5.3 | 2026-04-03 | Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 1… |
CVE-2026-22663 | High | 7.5 | 2026-04-03 | prompts.chat prior to commit 7b81836 contains multiple authorization bypass vulnerabilities due to missing isPrivate checks across API endpoints and page metad… |
CVE-2026-34759 | High | 8.1 | 2026-04-02 | OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authent… |
CVE-2026-33950 | Critical | 9.4 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by… |
CVE-2026-20155 | High | 8.0 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker with l… |
CVE-2026-5175 | Medium | 5.0 | 2026-04-01 | Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own conf… |
CVE-2026-4925 | Medium | 5.0 | 2026-04-01 | Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove th… |
CVE-2026-3831 | Medium | 4.3 | 2026-04-01 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check o… |
CVE-2026-34737 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the StripeYPT plugin includes a test.php debug endpoint that is accessible to any log… |
CVE-2026-34395 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with the… |
CVE-2026-4818 | Medium | 6.8 | 2026-03-31 | In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management opera… |
CVE-2026-1797 | Medium | 5.3 | 2026-03-31 | The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu… |
CVE-2026-34042 | High | 8.2 | 2026-03-31 | act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all i… |
CVE-2026-21716 | Low | 3.3 | 2026-03-30 | An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while the… |
CVE-2025-15445 | Medium | 5.4 | 2026-03-28 | The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, lik… |
CVE-2026-34046 | High | 8.8 | 2026-03-27 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/ap… |
CVE-2026-33887 | Medium | 5.4 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry… |
CVE-2026-4971 | Medium | 4.3 | 2026-03-27 | A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manipulation causes cross-site request forge… |
CVE-2026-34369 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_file` and `get_api_video` API endpoints in AVideo return… |
CVE-2026-29180 | High | 8.8 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer t… |
CVE-2026-4968 | Medium | 4.3 | 2026-03-27 | A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can… |
CVE-2026-34247 | Medium | 5.4 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` endpoint allows any authenticated user t… |
CVE-2026-34245 | Medium | 6.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/PlayLists/View/Playlists_schedules/add.json.php` endpoint allow… |
CVE-2026-5025 | Medium | 6.5 | 2026-03-27 | The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require b… |
CVE-2026-5022 | Medium | 5.3 | 2026-03-27 | The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to dow… |
CVE-2026-33761 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentica… |
CVE-2026-33759 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video cont… |
CVE-2026-4309 | Medium | 6.5 | 2026-03-27 | Missing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a specific device information and change the settings via netw… |
CVE-2026-3098 | Medium | 6.5 | 2026-03-27 | The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1.33 via the 'actionExportAll' function… |
CVE-2026-29070 | Medium | 5.4 | 2026-03-27 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an access control check is missing w… |
CVE-2026-33638 | Medium | 5.3 | 2026-03-26 | Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint… |
CVE-2026-33632 | High | 7.8 | 2026-03-26 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.4, two file operation event types — E… |