CWE-862
CVEs classified under CWE-862, newest first.
3021 CVEsRSS
CVE-2026-114175Medium· 5.4WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability
Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.
CVE-2026-114180Medium· 5.3WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2.
CVE-2026-112826Medium· 5.3WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n…
CVE-2026-111847Medium· 5.4WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.…
CVE-2026-112843Medium· 4.3WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14.
CVE-2026-114182Medium· 4.3WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elemento…
CVE-2026-110010Medium· 4.8MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a cus…
CVE-2026-109931Low· 3.7Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belon…
CVE-2026-96386Medium· 6.5Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
CVE-2026-96380Medium· 6.5CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189
Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.
CVE-2026-96391NoneWebform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
CVE-2026-87954Medium· 4.3Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152
Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.
CVE-2026-87955Medium· 4.3Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
CVE-2026-87943Medium· 6.5SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141
Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-84921Medium· 5.3Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133
Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
CVE-2026-84916Low· 3.7Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126
Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.
CVE-2026-84914Medium· 5.3Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122
Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.
CVE-2026-84913Medium· 4.6AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121
Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.
CVE-2026-84912Medium· 4.6AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.
CVE-2026-84910Medium· 4.2Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118
Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.
CVE-2026-114661High· 8.5OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST o…
CVE-2026-113797Low· 3.1Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
CVE-2026-76292Medium· 6.5Missing Authorization through REST API Endpoints in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secu…
CVE-2026-76294Medium· 4.3Improper Access Control in Field Extraction Management in Splunk Enterprise
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read acc…
CVE-2026-76296Medium· 4.3Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they …
CVE-2026-76305Medium· 6.5Improper Access Control during App Downloads in Splunk SOAR
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source c…
CVE-2026-76304Medium· 4.3Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Unif…
CVE-2026-76308Medium· 6.5Missing Authorization through the REST API in Splunk SOAR
In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change. The vulnerability is possib…
CVE-2026-114135High· 8.8jupyter-server: jupyter-server: Unauthorized code execution via missing authorization check in gateway handler (CVE-2026-114135)
A flaw was found in jupyter-server. When configured with a gateway connection, the server validates user authentication but fails to verify whether the user has permission to run actions on computational kernels. A remote authenticated use…
CVE-2026-105931Low· 2.3Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants
The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read endpoints of this API verify only that the request is authenticated …