CWE-862 · Missing Authorization (page 20)
Page 20 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32362 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Exploiting Incorrectly Configured Access… |
CVE-2026-32350 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in wpradiant Chocolate House chocolate-house allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-32348 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in MadrasThemes MAS Videos masvideos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-32347 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Restaurant and Cafe restaurant-and-cafe allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-32346 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Travel Agency travel-agency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-32345 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Perfect Portfolio perfect-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-32341 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Benevolent benevolent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-32340 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Business One Page business-one-page allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-32339 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Bakes And Cakes bakes-and-cakes allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-32338 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Construction Landing Page construction-landing-page allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-32337 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Preschool and Kindergarten preschool-and-kindergarten allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-32336 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Rara Business rara-business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-32335 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme The Conference the-conference allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-32334 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme JobScout jobscout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects J… |
CVE-2026-32332 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects E… |
CVE-2026-32331 | Medium | 5.4 | 2026-03-13 | Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-32329 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Ays Pro Advanced Related Posts advanced-related-posts allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-31919 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows Exploiting Incorrect… |
CVE-2026-31916 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-31915 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F… |
CVE-2026-2890 | High | 7.5 | 2026-03-13 | The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Lin… |
CVE-2026-22182 | High | 7.5 | 2026-03-13 | wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploitin… |
CVE-2026-32230 | Medium | 5.3 | 2026-03-12 | Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router… |
CVE-2026-28254 | High | 7.5 | 2026-03-12 | A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive informat… |
CVE-2026-21668 | High | 8.8 | 2026-03-12 | A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository. |
CVE-2025-15473 | Medium | 4.3 | 2026-03-12 | The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's p… |
CVE-2026-3977 | Medium | 6.3 | 2026-03-12 | A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipul… |
CVE-2026-3226 | Medium | 4.3 | 2026-03-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all… |
CVE-2026-32131 | High | 7.7 | 2026-03-11 | ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Management API has been reported, which allowed… |
CVE-2026-32126 | High | 7.1 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boolean condition in Con… |
CVE-2026-32122 | Medium | 4.3 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the Claim File Tracker feature expos… |
CVE-2026-1663 | Medium | 4.3 | 2026-03-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allow… |
CVE-2025-12704 | Low | 3.5 | 2026-03-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed… |
CVE-2026-3906 | Medium | 4.3 | 2026-03-11 | WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in… |
CVE-2026-29515 | Critical | 9.8 | 2026-03-11 | MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without… |
CVE-2026-1781 | Medium | 6.5 | 2026-03-11 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the… |
CVE-2026-31834 | High | 7.2 | 2026-03-10 | Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain cond… |
CVE-2026-31821 | Medium | 5.3 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenti… |
CVE-2026-31800 | Critical | 9.1 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.12 and 8.6.25, the _GraphQLConfig… |
CVE-2026-3582 | Medium | 4.3 | 2026-03-10 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PA… |
CVE-2026-26742 | High | 8.1 | 2026-03-10 | PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-a… |
CVE-2026-26741 | High | 8.1 | 2026-03-10 | PX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism. When switching from Auto mode to Manual mode while the drone… |
CVE-2026-30970 | Critical | 9.1 | 2026-03-10 | Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Cora… |
CVE-2026-30968 | Critical | 9.8 | 2026-03-10 | Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, the… |
CVE-2026-30959 | Medium | 5.0 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verificat… |
CVE-2026-30956 | Critical | 9.9 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in O… |
CVE-2026-30920 | High | 8.6 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and ins… |
CVE-2026-30885 | Medium | 5.3 | 2026-03-10 | WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requir… |
CVE-2026-27688 | Medium | 5.0 | 2026-03-10 | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer… |
CVE-2026-27687 | Medium | 5.8 | 2026-03-10 | Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges could access sensitive data belonging to a… |
CVE-2026-27686 | Medium | 5.9 | 2026-03-10 | Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC… |
CVE-2026-24313 | Medium | 5.0 | 2026-03-10 | SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing system… |
CVE-2026-24310 | Low | 3.5 | 2026-03-10 | Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read… |
CVE-2026-24309 | Medium | 6.4 | 2026-03-10 | Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read… |
CVE-2025-11158 | Critical | 9.1 | 2026-03-10 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports pu… |
CVE-2026-30926 | High | 7.1 | 2026-03-10 | SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allow… |
CVE-2026-28433 | Medium | 4.3 | 2026-03-10 | Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerabil… |
CVE-2026-25045 | High | 8.8 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR… |
CVE-2026-3638 | Medium | 5.9 | 2026-03-09 | Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to rest… |
CVE-2025-41765 | Critical | 9.1 | 2026-03-09 | Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This… |
CVE-2025-41764 | Critical | 9.1 | 2026-03-09 | Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates. |
CVE-2026-3770 | Medium | 4.3 | 2026-03-08 | A flaw has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part. This manipulation causes cross-site request fo… |
CVE-2026-30850 | Medium | 5.9 | 2026-03-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file met… |
CVE-2026-30842 | Medium | 4.3 | 2026-03-07 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploa… |
CVE-2026-30823 | High | 8.8 | 2026-03-07 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to ac… |
CVE-2026-27796 | Medium | 5.3 | 2026-03-07 | Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthentica… |
CVE-2026-2488 | Medium | 4.3 | 2026-03-07 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized message deletion due to a missing capability check o… |
CVE-2026-1650 | Medium | 5.3 | 2026-03-07 | The MDJM Event Management plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'custom_fields_controll… |
CVE-2026-2371 | Medium | 5.3 | 2026-03-07 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including… |
CVE-2026-1981 | Medium | 4.3 | 2026-03-07 | The HUMN-1 AI Website Scanner & Human Certification by Winston AI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa… |
CVE-2026-30233 | Medium | 6.5 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated use… |
CVE-2026-29789 | Critical | 9.9 | 2026-03-06 | Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authori… |
CVE-2026-30845 | High | 8.2 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication in Wekan publishes all integration data… |
CVE-2026-28080 | Medium | 4.3 | 2026-03-06 | Missing Authorization vulnerability in Rank Math Rank Math SEO PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects R… |
CVE-2026-29073 | High | 8.8 | 2026-03-06 | SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not a… |
CVE-2026-2446 | Critical | 9.8 | 2026-03-06 | The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to upda… |
CVE-2025-59544 | Medium | 4.3 | 2026-03-06 | Chamilo is a learning management system. Prior to version 1.11.34, the functionality for the user to update the category does not implement authorization check… |
CVE-2025-11791 | High | 7.1 | 2026-03-06 | Sensitive information disclosure and manipulation due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linu… |
CVE-2026-28790 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate runn… |
CVE-2026-30797 | High | 8.1 | 2026-03-05 | Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, conf… |
CVE-2026-1720 | High | 8.8 | 2026-03-05 | The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin… |
CVE-2026-1321 | High | 8.1 | 2026-03-05 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.20. This is due t… |
CVE-2026-3072 | Medium | 4.3 | 2026-03-05 | The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mla_update_compat_… |
CVE-2026-28104 | Medium | 6.5 | 2026-03-05 | Missing Authorization vulnerability in Aryan Shirani Bid Abadi Site Suggest site-suggest allows Accessing Functionality Not Properly Constrained by ACLs.This i… |
CVE-2026-28076 | High | 7.5 | 2026-03-05 | Missing Authorization vulnerability in Frenify Guff guff allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Guff: from… |
CVE-2026-28071 | Medium | 6.3 | 2026-03-05 | Missing Authorization vulnerability in PixFort pixfort Core pixfort-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-28038 | Medium | 6.5 | 2026-03-05 | Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured A… |
CVE-2026-27396 | High | 7.3 | 2026-03-05 | Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-27388 | High | 7.5 | 2026-03-05 | Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access C… |
CVE-2026-27386 | High | 7.5 | 2026-03-05 | Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access C… |
CVE-2026-27374 | High | 7.5 | 2026-03-05 | Missing Authorization vulnerability in vanquish WooCommerce Order Details woocommerce-order-details allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-27362 | Medium | 6.5 | 2026-03-05 | Missing Authorization vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-27361 | High | 7.5 | 2026-03-05 | Missing Authorization vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows Exploiting Incorrectly Configured Acce… |
CVE-2026-27344 | Medium | 5.9 | 2026-03-05 | Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-23799 | Medium | 6.5 | 2026-03-05 | Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor… |
CVE-2026-22479 | High | 7.5 | 2026-03-05 | Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2026-22459 | Medium | 6.5 | 2026-03-05 | Missing Authorization vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-69340 | High | 7.5 | 2026-03-05 | Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Confi… |
CVE-2026-2899 | Medium | 6.5 | 2026-03-05 | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `… |
CVE-2026-3056 | Medium | 4.3 | 2026-03-04 | The Seraphinite Accelerator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `seraph_accel_api`… |