CWE-862 · Missing Authorization (page 35)
Page 35 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11742 | Medium | 4.3 | 2025-10-18 | The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_qui… |
CVE-2025-11378 | Medium | 5.4 | 2025-10-18 | The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2025-62642 | Medium | 5.8 | 2025-10-17 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user accoun… |
CVE-2025-58075 | High | 8.1 | 2025-10-16 | Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original… |
CVE-2025-58073 | High | 8.1 | 2025-10-16 | Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original… |
CVE-2025-41410 | Medium | 5.4 | 2025-10-16 | Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attacke… |
CVE-2025-41443 | Medium | 4.3 | 2025-10-16 | Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows gues… |
CVE-2025-10849 | Medium | 5.3 | 2025-10-16 | The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_plugin_actions' f… |
CVE-2025-10706 | High | 8.8 | 2025-10-16 | The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb'… |
CVE-2025-11701 | Medium | 5.3 | 2025-10-15 | The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validati… |
CVE-2025-11692 | Medium | 5.3 | 2025-10-15 | The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php fi… |
CVE-2025-10648 | Medium | 5.3 | 2025-10-15 | The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mo… |
CVE-2025-10313 | High | 7.2 | 2025-10-15 | The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due… |
CVE-2025-10303 | Medium | 4.3 | 2025-10-15 | The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7_library_man… |
CVE-2025-10299 | High | 8.8 | 2025-10-15 | The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the… |
CVE-2025-10186 | Medium | 5.3 | 2025-10-15 | The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability che… |
CVE-2025-33182 | High | 7.6 | 2025-10-14 | NVIDIA Jetson Linux contains a vulnerability in UEFI, where improper authentication may allow a privileged user to cause corruption of the Linux Device Tree. A… |
CVE-2025-10732 | Medium | 4.3 | 2025-10-14 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and incl… |
CVE-2025-8682 | Medium | 4.3 | 2025-10-11 | The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() fu… |
CVE-2025-8593 | High | 8.8 | 2025-10-11 | The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a m… |
CVE-2025-11380 | Medium | 5.9 | 2025-10-11 | The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a mis… |
CVE-2025-9549 | Medium | 6.5 | 2025-10-10 | Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1. |
CVE-2025-11581 | Medium | 5.3 | 2025-10-10 | A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file /openApi/runJob of the component OpenAP… |
CVE-2025-11580 | Medium | 5.3 | 2025-10-10 | A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization… |
CVE-2025-8887 | Medium | 6.1 | 2025-10-10 | Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Infor… |
CVE-2025-8886 | Medium | 6.7 | 2025-10-10 | Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorizati… |
CVE-2025-59968 | High | 8.6 | 2025-10-09 | A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify… |
CVE-2025-10352 | | 2025-10-08 | Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator… | |
CVE-2025-11442 | Medium | 4.3 | 2025-10-08 | A security flaw has been discovered in JhumanJ OpnForm up to 1.9.3. The impacted element is an unknown function of the component API Endpoint. The manipulation… |
CVE-2025-11439 | Medium | 4.3 | 2025-10-08 | A vulnerability was found in JhumanJ OpnForm up to 1.9.3. This issue affects some unknown processing of the file /show/integrations. Performing manipulation re… |
CVE-2025-11438 | Medium | 6.3 | 2025-10-08 | A vulnerability has been found in JhumanJ OpnForm up to 1.9.3. This vulnerability affects unknown code of the file /custom-domains of the component API Endpoin… |
CVE-2025-9243 | High | 8.1 | 2025-10-04 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and u… |
CVE-2025-9029 | Medium | 4.3 | 2025-10-04 | The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to missing authorizatio… |
CVE-2025-11228 | Medium | 5.3 | 2025-10-04 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-9194 | Medium | 4.3 | 2025-10-03 | The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() function in all version… |
CVE-2025-10212 | Medium | 5.3 | 2025-10-03 | The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in… |
CVE-2020-36852 | Critical | 9.1 | 2025-10-01 | The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a… |
CVE-2025-11051 | Medium | 4.3 | 2025-09-27 | A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code. The manipulation leads to cross… |
CVE-2025-11029 | Medium | 4.3 | 2025-09-26 | A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request fo… |
CVE-2025-60166 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in wpshuffle WP Subscription Forms PRO wp-subscription-forms-pro allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-60165 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in HaruTheme Frames frames allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frame… |
CVE-2025-60159 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in webmaniabr Nota Fiscal Eletrônica WooCommerce nota-fiscal-eletronica-woocommerce allows Exploiting Incorrectly Configure… |
CVE-2025-60155 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-60152 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in wpshuffle Subscribe To Unlock subscribe-to-unlock allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-60148 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-60143 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm… |
CVE-2025-60130 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WEDOS G… |
CVE-2025-60129 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in Yext Yext yext allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Yext: from n/a through… |
CVE-2025-60128 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-60127 | Medium | 5.4 | 2025-09-26 | Missing Authorization vulnerability in ArtistScope CopySafe Web Protection wp-copysafe-web allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-60123 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-60122 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-60121 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-60120 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-60116 | Medium | 5.4 | 2025-09-26 | Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured… |
CVE-2025-60106 | Medium | 4.9 | 2025-09-26 | Missing Authorization vulnerability in Roxnor EmailKit emailkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Emai… |
CVE-2025-60103 | Medium | 5.4 | 2025-09-26 | Missing Authorization vulnerability in CridioStudio ListingPro listingpro-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-60098 | Medium | 6.5 | 2025-09-26 | Missing Authorization vulnerability in Jeff Farthing Theme My Login theme-my-login allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-60097 | Medium | 5.4 | 2025-09-26 | Missing Authorization vulnerability in CodexThemes TheGem thegem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The… |
CVE-2025-60096 | Medium | 5.4 | 2025-09-26 | Missing Authorization vulnerability in CodexThemes TheGem (Elementor) thegem-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-60094 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-59011 | High | 7.5 | 2025-09-26 | Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-58919 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in guihom Wide Banner wide-banner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-48326 | Medium | 6.5 | 2025-09-26 | Missing Authorization vulnerability in Acclectic Media Acclectic Media Organizer acclectic-media-organizer allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-10871 | Low | 3.8 | 2025-09-26 | An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can e… |
CVE-2025-9984 | Medium | 5.3 | 2025-09-26 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_po… |
CVE-2025-10173 | Low | 2.7 | 2025-09-26 | The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorr… |
CVE-2025-20362 | Medium | 6.5 | 2025-09-25 | Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases… |
CVE-2025-40837 | High | 8.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges… |
CVE-2025-59827 | Critical | 9.8 | 2025-09-24 | Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated… |
CVE-2025-59828 | Critical | 9.8 | 2025-09-24 | Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when… |
CVE-2025-9054 | Critical | 9.8 | 2025-09-24 | The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privi… |
CVE-2025-55038 | Medium | 6.8 | 2025-09-23 | An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the R… |
CVE-2025-59826 | High | 7.6 | 2025-09-23 | Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrec… |
CVE-2025-10184 | | 2025-09-23 | The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permissi… | |
CVE-2025-59591 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-59581 | Medium | 6.5 | 2025-09-22 | Missing Authorization vulnerability in VW THEMES Ibtana ibtana-visual-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-59576 | Medium | 6.5 | 2025-09-22 | Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-59567 | Medium | 5.5 | 2025-09-22 | Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-59561 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-59559 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in payrexx Payrexx Payment Gateway for WooCommerce woo-payrexx-gateway allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-59551 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-58969 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-58968 | Medium | 5.0 | 2025-09-22 | Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58957 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-58685 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in cecabank Cecabank WooCommerce Plugin cecabank-woocommerce allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-58681 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58680 | Medium | 6.5 | 2025-09-22 | Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gu… |
CVE-2025-58679 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in AppMySite AppMySite appmysite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-58678 | Medium | 6.5 | 2025-09-22 | Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-58672 | Medium | 5.4 | 2025-09-22 | Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-58668 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS… |
CVE-2025-58667 | Medium | 5.4 | 2025-09-22 | Missing Authorization vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-58666 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Kommo Website Chat Button: Kommo integration website-chat-button-kommo-integration allows Exploiting Incorrectly Configu… |
CVE-2025-58664 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Azizul Hasan Text To Speech TTS Accessibility text-to-audio allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-58663 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Themeum Qubely qubely allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Qubely… |
CVE-2025-58660 | Medium | 5.4 | 2025-09-22 | Missing Authorization vulnerability in brandexponents Oshine Core oshine-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-58650 | Medium | 5.4 | 2025-09-22 | Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-58258 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in nK Lazy Blocks lazy-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects La… |
CVE-2025-58251 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in POSIMYTH Sticky Header Effects for Elementor sticky-header-effects-for-elementor allows Exploiting Incorrectly Configure… |