CWE-862 · Missing Authorization (page 37)
Page 37 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-66140 | Medium | 5.4 | 2026-01-22 | Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-66139 | Medium | 5.4 | 2026-01-22 | Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66138 | Medium | 5.4 | 2026-01-22 | Missing Authorization vulnerability in merkulove Motionger for Elementor motionger-elementor allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-66137 | Medium | 5.4 | 2026-01-22 | Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-66136 | Medium | 5.4 | 2026-01-22 | Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66135 | Medium | 5.4 | 2026-01-22 | Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-63018 | Medium | 4.3 | 2026-01-22 | Missing Authorization vulnerability in wproyal Bard bard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bard: from… |
CVE-2025-62754 | Medium | 5.3 | 2026-01-22 | Missing Authorization vulnerability in Kapil Paul Payment Gateway bKash for WC woo-payment-bkash allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-62106 | Medium | 5.4 | 2026-01-22 | Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-5805 | Medium | 6.5 | 2026-01-22 | Missing Authorization vulnerability in Ninetheme Electron electron allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects E… |
CVE-2025-54002 | Medium | 6.5 | 2026-01-22 | Missing Authorization vulnerability in Jthemes xSmart xsmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects xSmart… |
CVE-2025-49375 | Medium | 5.4 | 2026-01-22 | Missing Authorization vulnerability in cozythemes HomeLancer homelancer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-65098 | High | 7.4 | 2026-01-22 | Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any… |
CVE-2026-24055 | Medium | 5.3 | 2026-01-22 | Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAu… |
CVE-2026-24042 | Critical | 9.4 | 2026-01-22 | Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users… |
CVE-2026-1036 | Medium | 5.3 | 2026-01-22 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2026-23990 | Medium | 5.3 | 2026-01-21 | The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0… |
CVE-2026-23517 | High | 8.1 | 2026-01-21 | Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenti… |
CVE-2026-0554 | Medium | 4.3 | 2026-01-20 | The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'regenerate' and 'reset' RES… |
CVE-2026-0548 | Medium | 5.4 | 2026-01-20 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check o… |
CVE-2025-15347 | High | 8.8 | 2026-01-20 | The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privileg… |
CVE-2025-15043 | Medium | 5.4 | 2026-01-20 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration… |
CVE-2025-14798 | Medium | 5.3 | 2026-01-20 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_… |
CVE-2025-14351 | Medium | 5.3 | 2026-01-20 | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'BCF_Google… |
CVE-2025-14978 | Medium | 5.3 | 2026-01-20 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized… |
CVE-2025-15466 | Medium | 5.4 | 2026-01-20 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on… |
CVE-2026-23875 | Medium | 5.4 | 2026-01-19 | CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing perm… |
CVE-2026-23721 | Medium | 4.3 | 2026-01-19 | OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visibl… |
CVE-2026-1169 | Medium | 4.3 | 2026-01-19 | A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site r… |
CVE-2026-23522 | Low | 3.7 | 2026-01-19 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticate… |
CVE-2026-1153 | Medium | 4.3 | 2026-01-19 | A vulnerability was detected in technical-laohu mpay up to 1.2.4. This affects an unknown function. Performing a manipulation results in cross-site request for… |
CVE-2026-1148 | Medium | 4.3 | 2026-01-19 | A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This vulnerability affects unknown code. Exec… |
CVE-2026-1142 | Medium | 4.3 | 2026-01-19 | A security flaw has been discovered in PHPGurukul News Portal 1.0. The impacted element is an unknown function. Performing a manipulation results in cross-site… |
CVE-2025-14078 | Medium | 5.3 | 2026-01-17 | The PAYGENT for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.6. This is due to missing aut… |
CVE-2025-14029 | Medium | 5.3 | 2026-01-17 | The Community Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_admin_event_approval… |
CVE-2025-12825 | Medium | 5.3 | 2026-01-17 | The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_cf7_… |
CVE-2025-12168 | Medium | 4.3 | 2026-01-17 | The Phrase TMS Integration for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_a… |
CVE-2026-0820 | Medium | 4.3 | 2026-01-17 | The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capabili… |
CVE-2025-14463 | Medium | 5.3 | 2026-01-17 | The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to… |
CVE-2025-14450 | Medium | 6.5 | 2026-01-17 | The Wallet System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'change_wall… |
CVE-2026-1004 | Medium | 5.3 | 2026-01-16 | The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael… |
CVE-2025-14757 | Medium | 5.3 | 2026-01-16 | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when u… |
CVE-2026-1003 | Medium | 4.3 | 2026-01-16 | The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly ver… |
CVE-2026-1000 | Medium | 6.5 | 2026-01-16 | The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including… |
CVE-2025-14982 | Medium | 4.3 | 2026-01-16 | The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-14384 | Medium | 4.3 | 2026-01-16 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a mi… |
CVE-2025-12641 | Medium | 6.5 | 2026-01-16 | The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions… |
CVE-2025-64729 | High | 8.1 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and… |
CVE-2021-47812 | Critical | 9.8 | 2026-01-16 | GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the sc… |
CVE-2025-13859 | Medium | 6.4 | 2026-01-15 | The AffiliateX – Amazon Affiliate Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_… |
CVE-2025-12895 | Medium | 5.3 | 2026-01-15 | The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the… |
CVE-2025-14457 | Low | 3.7 | 2026-01-15 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership ch… |
CVE-2026-23477 | High | 7.7 | 2026-01-14 | Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-app… |
CVE-2025-15512 | Medium | 5.3 | 2026-01-14 | The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_success_respo… |
CVE-2025-15475 | Medium | 5.3 | 2026-01-14 | The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improper validation logic… |
CVE-2025-14173 | Medium | 5.3 | 2026-01-14 | The Perfit WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. This is due to missing authoriz… |
CVE-2026-0635 | Medium | 4.3 | 2026-01-14 | The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordio… |
CVE-2025-14880 | Medium | 5.3 | 2026-01-14 | The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle… |
CVE-2025-14854 | Medium | 5.4 | 2026-01-14 | The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system… |
CVE-2025-14482 | Medium | 4.3 | 2026-01-14 | The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capa… |
CVE-2025-68947 | Medium | 4.7 | 2026-01-13 | NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected… |
CVE-2025-11669 | High | 8.1 | 2026-01-13 | Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an… |
CVE-2025-59022 | High | 8.1 | 2026-01-13 | Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had per… |
CVE-2025-59021 | Medium | 6.4 | 2026-01-13 | Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record with… |
CVE-2025-14001 | Medium | 5.4 | 2026-01-13 | The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and… |
CVE-2026-0511 | High | 8.1 | 2026-01-13 | SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile… |
CVE-2026-0506 | High | 8.1 | 2026-01-13 | Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to exec… |
CVE-2026-0503 | Medium | 6.4 | 2026-01-13 | Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-t… |
CVE-2026-0497 | Medium | 4.3 | 2026-01-13 | SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This results in a low i… |
CVE-2025-14948 | Medium | 5.3 | 2026-01-10 | The miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2026-0817 | Medium | 5.3 | 2026-01-09 | Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - Campaign… |
CVE-2025-14172 | Medium | 6.5 | 2026-01-09 | The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing… |
CVE-2025-13717 | Medium | 5.3 | 2026-01-09 | The Contact Form vCard Generator plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wp_gvccf_check_dow… |
CVE-2025-13781 | Medium | 6.5 | 2026-01-09 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed… |
CVE-2025-13772 | High | 7.1 | 2026-01-09 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed… |
CVE-2025-14741 | Critical | 9.1 | 2026-01-09 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing ca… |
CVE-2025-14657 | High | 7.2 | 2026-01-09 | The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2025-14146 | Medium | 5.3 | 2026-01-09 | The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the `WPBC_FLEXTIME… |
CVE-2025-13935 | Medium | 4.3 | 2026-01-09 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including… |
CVE-2025-13934 | Medium | 4.3 | 2026-01-09 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including… |
CVE-2025-13628 | Medium | 4.3 | 2026-01-09 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capa… |
CVE-2025-14782 | Medium | 5.3 | 2026-01-09 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i… |
CVE-2025-14720 | Medium | 5.3 | 2026-01-09 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on multipl… |
CVE-2025-14718 | Medium | 5.4 | 2026-01-09 | The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This… |
CVE-2025-14886 | Medium | 5.3 | 2026-01-09 | The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `order` REST API… |
CVE-2026-22522 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in Munir Kamal Block Slider block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-22517 | Medium | 5.4 | 2026-01-08 | Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-22492 | Medium | 4.3 | 2026-01-08 | Missing Authorization vulnerability in Nawawi Jamili Docket Cache docket-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-22490 | Medium | 5.4 | 2026-01-08 | Missing Authorization vulnerability in niklaslindemann Bulk Landing Page Creator for WordPress LPagery lpagery allows Exploiting Incorrectly Configured Access… |
CVE-2026-22488 | Medium | 5.3 | 2026-01-08 | Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectl… |
CVE-2026-22487 | Medium | 4.3 | 2026-01-08 | Missing Authorization vulnerability in baqend Speed Kit baqend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Speed… |
CVE-2026-22486 | Medium | 5.3 | 2026-01-08 | Missing Authorization vulnerability in Re Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Re Gallery: from n… |
CVE-2026-0676 | Medium | 5.3 | 2026-01-08 | Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zorka: fr… |
CVE-2026-0674 | Medium | 4.3 | 2026-01-08 | Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-67926 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-67917 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-67913 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
CVE-2025-22715 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Exploiting In… |
CVE-2025-14360 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: fro… |
CVE-2025-14358 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |