Export limit exceeded: 11995 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11995 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123148 | 2 Tms, Wordpress-extensions | 2 Ivyforms, Ivyforms | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1. | ||||
| CVE-2026-119513 | 2 Ahmad, Wordpress-extensions | 2 Js Help Desk, Js Help Desk | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.3. | ||||
| CVE-2026-123462 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-122660 | 2 Bakkbone Australia, Wordpress-extensions | 2 Floristpress, Floristpress | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5. | ||||
| CVE-2026-106027 | 1 Wordpress-extensions | 1 Oxygen Mydata For Woocommerce | 2026-11-12 | 5.3 Medium |
| The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed. | ||||
| CVE-2026-121668 | 1 Microsoft | 1 Azure Confidential Clean Room | 2026-11-12 | 7.7 High |
| Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network. | ||||
| CVE-2026-96845 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-11-12 | 7.8 High |
| Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-121574 | 2 Wordpress-extensions, Wpchill | 2 Passster, Passster | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20. | ||||
| CVE-2026-96029 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-12 | 7.8 High |
| Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96133 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-12 | 5.5 Medium |
| Improper access control in Windows Graphics Kernel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-88176 | 1 Microsoft | 1 Sharepoint Server | 2026-11-12 | 8.8 High |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-125431 | 2026-11-12 | 5.3 Medium | ||
| Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Food Menu – Restaurant Menu & Online Ordering for WooCommerce: from n/a through 6.0.7. | ||||
| CVE-2026-125046 | 2026-11-12 | 5.3 Medium | ||
| Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1. | ||||
| CVE-2026-120805 | 1 Mongodb | 1 Mongodb Server | 2026-11-12 | 4.3 Medium |
| In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. The server’s authorization layer validated only the user-facing target collection namespace, while subsequent internal writes derived from client-supplied parameters were performed with elevated internal privileges, bypassing the original caller’s permission scope. This could allow unauthorized writes into another collection’s Queryable Encryption metadata, potentially corrupting encrypted index state and compaction operations. | ||||
| CVE-2026-120823 | 1 Mongodb | 1 Mongodb Server | 2026-11-12 | 4.3 Medium |
| A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information. | ||||
| CVE-2026-120825 | 1 Mongodb | 1 Mongodb Server | 2026-11-12 | 6.5 Medium |
| An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material. | ||||
| CVE-2026-118408 | 1 Apache | 1 Roller | 2026-11-12 | 3.1 Low |
| Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries. | ||||
| CVE-2026-105440 | 2 Extreme Networks, Extremenetworks | 2 Switch Engine (exos), Switch Engine (exos) | 2026-11-12 | 6.5 Medium |
| Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosure of sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device. This issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11. Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure. | ||||
| CVE-2026-123481 | 2026-11-12 | 4.3 Medium | ||
| Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2. | ||||
| CVE-2026-92083 | 2026-11-12 | 7.8 High | ||
| Missing Authorization vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pardus-image-writer allows Privilege Escalation. This issue affects pardus-image-writer: before 0.9.0. | ||||