CWE-862 · Missing Authorization (page 29)
Page 29 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3831 | Medium | 4.3 | 2026-04-01 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check o… |
CVE-2026-34737 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the StripeYPT plugin includes a test.php debug endpoint that is accessible to any log… |
CVE-2026-34395 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with the… |
CVE-2026-4818 | Medium | 6.8 | 2026-03-31 | In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management opera… |
CVE-2026-1797 | Medium | 5.3 | 2026-03-31 | The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu… |
CVE-2026-34042 | High | 8.2 | 2026-03-31 | act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all i… |
CVE-2026-21716 | Low | 3.3 | 2026-03-30 | An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while the… |
CVE-2025-15445 | Medium | 5.4 | 2026-03-28 | The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, lik… |
CVE-2026-34046 | High | 8.8 | 2026-03-27 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/ap… |
CVE-2026-33887 | Medium | 5.4 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry… |
CVE-2026-4971 | Medium | 4.3 | 2026-03-27 | A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manipulation causes cross-site request forge… |
CVE-2026-34369 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_file` and `get_api_video` API endpoints in AVideo return… |
CVE-2026-29180 | High | 8.8 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer t… |
CVE-2026-4968 | Medium | 4.3 | 2026-03-27 | A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can… |
CVE-2026-34247 | Medium | 5.4 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` endpoint allows any authenticated user t… |
CVE-2026-34245 | Medium | 6.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/PlayLists/View/Playlists_schedules/add.json.php` endpoint allow… |
CVE-2026-5025 | Medium | 6.5 | 2026-03-27 | The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require b… |
CVE-2026-5022 | Medium | 5.3 | 2026-03-27 | The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to dow… |
CVE-2026-33761 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentica… |
CVE-2026-33759 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video cont… |
CVE-2026-4309 | Medium | 6.5 | 2026-03-27 | Missing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a specific device information and change the settings via netw… |
CVE-2026-3098 | Medium | 6.5 | 2026-03-27 | The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1.33 via the 'actionExportAll' function… |
CVE-2026-29070 | Medium | 5.4 | 2026-03-27 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an access control check is missing w… |
CVE-2026-33638 | Medium | 5.3 | 2026-03-26 | Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint… |
CVE-2026-33632 | High | 7.8 | 2026-03-26 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.4, two file operation event types — E… |
CVE-2026-33631 | High | 8.7 | 2026-03-26 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter En… |
CVE-2026-33495 | Medium | 6.5 | 2026-03-26 | ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Ory Oathkeeper… |
CVE-2026-33470 | Medium | 6.5 | 2026-03-26 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-privilege authenticated user restricted… |
CVE-2026-33413 | High | 8.8 | 2026-03-26 | etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, unauthorized users may bypass authenti… |
CVE-2026-4331 | Medium | 4.3 | 2026-03-26 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. T… |
CVE-2026-4281 | Medium | 5.3 | 2026-03-26 | The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 7.5.21. This is due t… |
CVE-2026-4484 | High | 8.8 | 2026-03-26 | The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a… |
CVE-2026-34053 | High | 7.1 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the… |
CVE-2026-33934 | Medium | 4.3 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a missing authorization… |
CVE-2026-33918 | High | 7.6 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download en… |
CVE-2026-33915 | Medium | 5.4 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, five insurance company REST… |
CVE-2026-32562 | Medium | 5.4 | 2026-03-25 | Missing Authorization vulnerability in WP Folio Team PPWP password-protect-page allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-32546 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-32541 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Premmerce Premmerce Redirect Manager premmerce-redirect-manager allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-32527 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-insightly allows Exploitin… |
CVE-2026-32515 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-32514 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Anton Voytenko Petitioner petitioner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-32501 | High | 7.1 | 2026-03-25 | Missing Authorization vulnerability in wp-configurator WP Configurator Pro wp-configurator-pro allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-32498 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Confi… |
CVE-2026-32495 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in Link Software LLC WP Terms Popup wp-terms-popup allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-32489 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B… |
CVE-2026-32485 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-32483 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2026-32441 | High | 7.7 | 2026-03-25 | Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Co… |
CVE-2026-31921 | High | 8.2 | 2026-03-25 | Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Confi… |
CVE-2026-27071 | Critical | 9.1 | 2026-03-25 | Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCa… |
CVE-2026-27046 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Kaira StoreCustomizer woocustomizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-25469 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in ViaBill for WooCommerce ViaBill – WooCommerce viabill-woocommerce allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-25462 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in avalex avalex avalex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects avalex… |
CVE-2026-25460 | Medium | 6.3 | 2026-03-25 | Missing Authorization vulnerability in LiquidThemes Ave Core ave-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-25456 | High | 7.3 | 2026-03-25 | Missing Authorization vulnerability in Aarsiv Groups Automated FedEx live/manual rates with shipping labels a2z-fedex-shipping allows Exploiting Incorrectly Co… |
CVE-2026-25455 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access C… |
CVE-2026-25454 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in MVPThemes The League the-league allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-25437 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in سید محمدامین هاشمی GZSEO gzseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-25430 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting… |
CVE-2026-25401 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-25398 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Co… |
CVE-2026-25396 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured… |
CVE-2026-25390 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-25365 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-25327 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Con… |
CVE-2026-25317 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly C… |
CVE-2026-25309 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-25034 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-25026 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tea… |
CVE-2026-25009 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24987 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in activity-log.com WP System Log winterlock allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-24972 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Elated-Themes Elated Listing eltd-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-24382 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in wproyal News Magazine X news-magazine-x allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24376 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Javier Casares WPVulnerability wpvulnerability allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-24369 | High | 7.1 | 2026-03-25 | Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid… |
CVE-2026-24364 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-24363 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Con… |
CVE-2026-24362 | Medium | 6.4 | 2026-03-25 | Missing Authorization vulnerability in bdthemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-23977 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorre… |
CVE-2026-23972 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Confi… |
CVE-2026-23806 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22485 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Ruhul Amin My Album Gallery my-album-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-69358 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-14595 | Medium | 4.3 | 2026-03-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain con… |
CVE-2026-33353 | Medium | 6.5 | 2026-03-24 | Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any aut… |
CVE-2026-33768 | Medium | 6.5 | 2026-03-24 | Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to… |
CVE-2026-33162 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 5.3.0 to before version 5.9.14, an authenticated control panel user with only accessCp can move en… |
CVE-2026-33161 | Medium | 4.3 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-priv… |
CVE-2026-33160 | Medium | 5.3 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthe… |
CVE-2026-33159 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest user… |
CVE-2026-33316 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regai… |
CVE-2026-33484 | High | 7.5 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}… |
CVE-2026-4283 | Critical | 9.1 | 2026-03-24 | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to, and including, 3.1.38. This is due to t… |
CVE-2026-3138 | Medium | 6.5 | 2026-03-24 | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to… |
CVE-2026-33290 | Medium | 4.3 | 2026-03-24 | WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.10.0, an authorization flaw in updateComment allows an authenticated low-privileged us… |
CVE-2026-4056 | Medium | 5.4 | 2026-03-24 | The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Acc… |
CVE-2026-4066 | Medium | 4.3 | 2026-03-23 | The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() fu… |
CVE-2026-3225 | Medium | 4.3 | 2026-03-23 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in… |
CVE-2026-33685 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/AD_Server/reports.json.php` endpoint performs no authentication… |