CWE-862
CVEs classified under CWE-862, newest first.
3503 CVEsRSS
CVE-2026-106511Critical· 9.8PoCMultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account wi…
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account wi…
CVE-2026-56952Medium· 6.7In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check
In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction i…
CVE-2026-103620Medium· 6.0A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branc…
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branc…
CVE-2026-0198Medium· 4.4In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check
In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitat…
CVE-2026-104070Critical· 9.8The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, c…
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, c…
CVE-2026-105859Critical· 9.8Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents…
CVE-2026-105860High· 7.1Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated use…
CVE-2026-105848Critical· 9.6⚖ disputedPayload is a free and open source headless content management system
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST pr…
CVE-2026-105852High· 7.5Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information a…
CVE-2026-105849High· 8.3Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with…
CVE-2026-63691Medium· 6.1Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated attacker with adjacent network access could potentially…
CVE-2026-105806High· 8.6Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation …
CVE-2026-106041Medium· 6.5PoCMooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK replicas through the NotifyOffloadSuccess RPC
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local dis…
CVE-2026-106040High· 8.2Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cor…
CVE-2026-106039Medium· 6.5PoCMooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCo…
CVE-2026-25433High· 7.1Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
CVE-2026-32578High· 7.1Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
CVE-2026-39730High· 7.1Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.
CVE-2026-39749Medium· 6.5Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
CVE-2026-39751High· 7.5Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
CVE-2026-39762Medium· 6.5Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud fo…
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud fo…
CVE-2026-39787Medium· 6.5Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
CVE-2026-39794High· 7.5Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.
CVE-2026-39798Medium· 6.5Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.
Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.
CVE-2026-39796High· 7.5Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.
CVE-2026-41560High· 7.5Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.
Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.
CVE-2026-42638High· 7.5Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
CVE-2026-42637Medium· 6.5Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
CVE-2026-62072High· 8.8Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
CVE-2026-48199High· 7.5Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.