CWE-862
CVEs classified under CWE-862, newest first.
3415 CVEsRSS
CVE-2026-54871Medium· 5.3WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooCo…
CVE-2026-114181Medium· 5.3WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for Woo…
CVE-2026-25450Medium· 5.3WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.
CVE-2026-118760Medium· 6.5Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested …
CVE-2026-19610Medium· 6.5Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resou…
CVE-2026-118093Medium· 5.3WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.
CVE-2026-39735Medium· 6.5WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.
CVE-2026-42703Medium· 6.5WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.
CVE-2026-22386Medium· 4.3WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1.
CVE-2026-42707Medium· 4.3WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.
CVE-2026-39741Medium· 5.3WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a throug…
CVE-2026-115963High· 7.1WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/…
CVE-2026-115599High· 7.5WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.
CVE-2026-114193High· 7.5WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5.
CVE-2026-112827High· 7.1WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce handmade-dropshipping-for-etsy-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HANDMADE…
CVE-2026-27401Medium· 5.3WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal …
CVE-2026-115302Medium· 5.3Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
CVE-2026-78395Medium· 5.3Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to requi…
CVE-2026-108685Low· 3.7WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website o…
CVE-2026-110030Medium· 5.3Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration
The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in sessio…
CVE-2026-117627Medium· 5.4Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions
A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correct…
CVE-2026-118426Medium· 5.3In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.
In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.
GHSA-w9x9-j56r-h98rHigh· 8.2@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
CVE-2026-118804High· 7.5Bricks Broken Access Control via query_result Endpoint
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parame…
CVE-2026-75520Medium· 5.4Domoticz: Missing authorization and path traversal in the udevices Lua parser handler
Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` chec…
CVE-2026-61571High· 7.3PoCAVideo-Encoder: missing authentication on control and status endpoints
AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder:…
CVE-2026-118754Medium· 5.3PoCDolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisi…
CVE-2026-118757Medium· 6.5PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' order…
CVE-2026-116794High· 8.3PoCrussh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONST…
CVE-2026-105612Low· 3.5PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles
PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions