CWE-862 · Missing Authorization (page 34)
Page 34 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14357 | Medium | 5.3 | 2026-02-19 | The Mega Store Woocommerce theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setup_widgets() func… |
CVE-2025-14342 | Medium | 4.3 | 2026-02-19 | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sq_ajax_uninsta… |
CVE-2025-14270 | Low | 2.7 | 2026-02-19 | The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not pr… |
CVE-2025-13930 | Medium | 5.3 | 2026-02-19 | The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 7.8… |
CVE-2025-13864 | Medium | 5.3 | 2026-02-19 | The Breeze - WordPress Cache Plugin plugin for WordPress is vulnerable to unauthorized cache clearing in all versions up to, and including, 2.2.21. This is due… |
CVE-2025-13603 | High | 8.8 | 2026-02-19 | The WP AUDIO GALLERY plugin for WordPress is vulnerable to Unauthorized Arbitrary File Read in all versions up to, and including, 2.0. This is due to insuffici… |
CVE-2025-12975 | High | 7.2 | 2026-02-19 | The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability ch… |
CVE-2025-12845 | High | 8.8 | 2026-02-19 | The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads… |
CVE-2025-12081 | Medium | 4.3 | 2026-02-19 | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "acf_photo_gallery… |
CVE-2025-12027 | Medium | 4.3 | 2026-02-19 | The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the "openPageIn… |
CVE-2025-11754 | High | 7.5 | 2026-02-19 | The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'gdpr/v1/settings' REST API… |
CVE-2025-11725 | Medium | 6.5 | 2026-02-19 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the multiple functions in… |
CVE-2026-27181 | High | 7.5 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method read… |
CVE-2019-25351 | High | 8.8 | 2026-02-18 | Centova Cast 3.2.11 contains a file download vulnerability that allows authenticated attackers to retrieve arbitrary system files through the server.copyfile A… |
CVE-2026-1355 | Medium | 6.5 | 2026-02-18 | A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s repo… |
CVE-2026-2658 | Medium | 4.3 | 2026-02-18 | A vulnerability was found in newbee-ltd newbee-mall up to a069069b07027613bf0e7f571736be86f431faee. Affected is an unknown function of the component Multiple E… |
CVE-2025-70150 | Critical | 9.8 | 2026-02-18 | CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delet… |
CVE-2025-70148 | High | 7.5 | 2026-02-18 | Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access… |
CVE-2025-70147 | High | 7.5 | 2026-02-18 | Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitiv… |
CVE-2025-70146 | Critical | 9.1 | 2026-02-18 | Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perf… |
CVE-2025-70141 | Critical | 9.4 | 2026-02-18 | SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication… |
CVE-2026-1942 | Medium | 6.5 | 2026-02-18 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2026-2127 | Medium | 5.4 | 2026-02-18 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all versions up to, and including, 1.70.4. Th… |
CVE-2026-1656 | Medium | 5.3 | 2026-02-18 | The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6… |
CVE-2026-1938 | Medium | 5.3 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the… |
CVE-2026-1860 | Medium | 4.3 | 2026-02-18 | The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.8. This is due to the `get_item… |
CVE-2026-1831 | Low | 2.7 | 2026-02-18 | The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability chec… |
CVE-2026-1655 | Medium | 4.3 | 2026-02-18 | The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4… |
CVE-2026-2633 | Medium | 4.3 | 2026-02-18 | The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due… |
CVE-2026-1937 | High | 7.2 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to… |
CVE-2026-1640 | Medium | 4.3 | 2026-02-18 | The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin… |
CVE-2026-1906 | Medium | 4.3 | 2026-02-18 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5… |
CVE-2025-12356 | Medium | 4.3 | 2026-02-18 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp… |
CVE-2026-1925 | Medium | 4.3 | 2026-02-18 | The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on… |
CVE-2025-12075 | Medium | 4.3 | 2026-02-18 | The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wos_troubleshoot… |
CVE-2024-31118 | Medium | 6.5 | 2026-02-17 | Missing Authorization vulnerability in Smartypants SP Project & Document Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2022-41650 | Medium | 6.5 | 2026-02-17 | Missing Authorization vulnerability in Paul Custom Content by Country (by Shield Security) custom-content-by-country.This issue affects Custom Content by Count… |
CVE-2026-2608 | Medium | 4.3 | 2026-02-17 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a… |
CVE-2026-25903 | Medium | 6.6 | 2026-02-17 | Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permission… |
CVE-2026-0829 | Medium | 5.8 | 2026-02-17 | The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This l… |
CVE-2026-1657 | Medium | 5.3 | 2026-02-17 | The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin re… |
CVE-2026-2001 | High | 8.8 | 2026-02-16 | The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin… |
CVE-2025-14573 | Low | 3.8 | 2026-02-16 | Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissi… |
CVE-2025-14350 | Medium | 4.3 | 2026-02-16 | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which all… |
CVE-2026-0998 | Medium | 4.3 | 2026-02-16 | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post… |
CVE-2026-0929 | Medium | 4.3 | 2026-02-16 | The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site. |
CVE-2026-26368 | High | 8.8 | 2026-02-15 | eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated lo… |
CVE-2026-26367 | High | 8.1 | 2026-02-15 | eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated l… |
CVE-2026-2312 | Medium | 4.3 | 2026-02-14 | The Media Library Folders plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 8.3.6 via the delete_max… |
CVE-2026-1254 | Medium | 4.3 | 2026-02-14 | The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.6… |
CVE-2026-2022 | Medium | 4.3 | 2026-02-14 | The Smart Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'rednao_smart_forms_get_campaigns' A… |
CVE-2026-1944 | Medium | 5.3 | 2026-02-14 | The CallbackKiller service widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cbk_save() f… |
CVE-2026-1303 | Medium | 5.3 | 2026-02-14 | The MailChimp Campaigns plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.2.4. This is due to missing capabil… |
CVE-2026-0727 | Medium | 5.4 | 2026-02-14 | The Accordion and Accordion Slider plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.5. This is due to the p… |
CVE-2026-1932 | Medium | 5.3 | 2026-02-14 | The Appointment Booking Calendar Plugin – Bookr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th… |
CVE-2026-0692 | High | 7.5 | 2026-02-14 | The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.4.0. This is d… |
CVE-2025-14608 | Medium | 5.3 | 2026-02-14 | The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to th… |
CVE-2025-14067 | Medium | 5.3 | 2026-02-14 | The Easy Form Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX actions in all versi… |
CVE-2025-15157 | High | 8.8 | 2026-02-13 | The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege esc… |
CVE-2026-26268 | High | 8.0 | 2026-02-13 | Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent (… |
CVE-2026-25531 | Medium | 4.3 | 2026-02-13 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::d… |
CVE-2026-25768 | Medium | 6.5 | 2026-02-12 | LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have ac… |
CVE-2026-1104 | High | 8.8 | 2026-02-12 | The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capabil… |
CVE-2026-1671 | Medium | 6.5 | 2026-02-12 | The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the winter_activity_log_a… |
CVE-2026-1537 | Medium | 5.3 | 2026-02-12 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabili… |
CVE-2026-20626 | High | 7.8 | 2026-02-11 | This issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Tahoe 26.3, visionOS 26.3. A malici… |
CVE-2026-25633 | Medium | 4.3 | 2026-02-11 | Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able t… |
CVE-2025-13391 | Medium | 5.8 | 2026-02-11 | The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to unauthorized loss of data due to a… |
CVE-2025-14592 | Low | 3.7 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2026-1833 | Medium | 5.3 | 2026-02-11 | The WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to t… |
CVE-2026-1786 | Medium | 6.5 | 2026-02-11 | The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' func… |
CVE-2026-1748 | Medium | 4.3 | 2026-02-11 | The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on mult… |
CVE-2025-15400 | Medium | 6.5 | 2026-02-11 | The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration opti… |
CVE-2025-15524 | Medium | 4.3 | 2026-02-11 | The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax_get_gallery_info() fu… |
CVE-2026-25609 | Medium | 5.4 | 2026-02-10 | Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only. |
CVE-2026-21743 | High | 7.2 | 2026-02-10 | A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versi… |
CVE-2025-14895 | Medium | 5.4 | 2026-02-10 | The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly ver… |
CVE-2026-1722 | Medium | 5.3 | 2026-02-10 | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an… |
CVE-2026-24327 | Medium | 4.3 | 2026-02-10 | Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access… |
CVE-2026-24326 | Medium | 4.3 | 2026-02-10 | Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-e… |
CVE-2026-24322 | High | 7.7 | 2026-02-10 | SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing sensit… |
CVE-2026-24312 | Medium | 5.2 | 2026-02-10 | An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by l… |
CVE-2026-23688 | Medium | 4.3 | 2026-02-10 | SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Thi… |
CVE-2026-23681 | Medium | 4.3 | 2026-02-10 | Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retri… |
CVE-2026-0509 | Critical | 9.6 | 2026-02-10 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the re… |
CVE-2026-0490 | High | 7.5 | 2026-02-10 | SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication… |
CVE-2026-0488 | Critical | 9.9 | 2026-02-10 | An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critica… |
CVE-2026-0486 | Medium | 5.0 | 2026-02-10 | In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of… |
CVE-2026-0484 | Medium | 6.5 | 2026-02-10 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code… |
CVE-2026-0845 | High | 7.2 | 2026-02-10 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modificatio… |
CVE-2026-25939 | Critical | 9.1 | 2026-02-09 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA… |
CVE-2026-25808 | High | 7.5 | 2026-02-09 | Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerabil… |
CVE-2026-25876 | Critical | 9.1 | 2026-02-09 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authenticatio… |
CVE-2026-25810 | Critical | 9.1 | 2026-02-09 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify au… |
CVE-2026-25806 | Medium | 6.5 | 2026-02-09 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status… |
CVE-2026-24777 | Medium | 6.7 | 2026-02-09 | OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This f… |
CVE-2026-24095 | | 2026-02-09 | Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p21, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows users with the "Use WATO" permission t… | |
CVE-2026-2208 | Medium | 4.3 | 2026-02-08 | A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of the component Rules… |
CVE-2025-15476 | Medium | 4.3 | 2026-02-07 | The The Bucketlister plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bucketlister_do_admin_aja… |
CVE-2026-2065 | Medium | 6.3 | 2026-02-06 | A security flaw has been discovered in Flycatcher Toys smART Pixelator 2.0. Affected by this issue is some unknown functionality of the component Bluetooth Low… |