Overview 7,552 matches · 344 in Waratek scope · 1 protected · 87 exploited · 3 CISA KEV · 55 public PoC · 3 EPSS ≥ 0.5
7,552matches
344in Waratek scope4.6%
1protected0.0%
87exploited1.2%
3CISA KEV0.0%
55public PoC0.7%
3EPSS ≥ 0.50.0%
Protected by Waratek
1
0.0%
Rule in development
0
0.0%
Mitigation candidate
6
0.1%
No exploit published
337
4.5%
Outside Waratek scope
11
0.1%
Not applicable
7,197
95.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.0%
partly blocked
0
0.0%
not blocked
7,551
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 3,304 / year
20051
Not applicable1
Medium1
not blocked1
No public exploit1
20061
No exploit published1
Medium1
not blocked1
No public exploit1
20070
20080
20092
Not applicable2
Medium2
not blocked2
No public exploit2
20101
No exploit published1
Medium1
not blocked1
No public exploit1
20110
20121
Not applicable1
Medium1
not blocked1
No public exploit1
20130
20140
20150
20160
201711
No exploit published3
Outside Waratek scope1
Not applicable7
Medium11
not blocked11
No public exploit11
201822
No exploit published5
Not applicable17
Medium22
not blocked22
No public exploit22
2019110
No exploit published44
Not applicable66
Medium110
not blocked110
Exploited1
Working exploit published3
No public exploit106
2020139
No exploit published22
Outside Waratek scope1
Not applicable116
Medium139
not blocked139
Exploited1
No public exploit138
2021120
No exploit published19
Outside Waratek scope2
Not applicable99
Medium120
not blocked120
Exploited6
Working exploit published2
No public exploit112
2022281
No exploit published85
Not applicable196
Medium281
not blocked281
Exploited5
Working exploit published3
Proof of concept only17
No public exploit256
2023556
No exploit published48
Not applicable508
Medium556
not blocked556
Exploited15
Working exploit published1
Proof of concept only30
No public exploit510
20241,257
Mitigation candidate1
No exploit published10
Outside Waratek scope5
Not applicable1,241
Medium1,257
not blocked1,257
Exploited28
Working exploit published8
Proof of concept only40
No public exploit1,181
20251,746
Mitigation candidate4
No exploit published23
Not applicable1,719
Medium1,746
not blocked1,746
Exploited15
Working exploit published4
Proof of concept only63
No public exploit1,664
20263,304
Protected by Waratek1
Mitigation candidate1
No exploit published76
Outside Waratek scope2
Not applicable3,224
Medium3,304
blocked by ARMR today1
not blocked3,303
Exploited16
Working exploit published16
Proof of concept only415
No public exploit2,857
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-63173 | Medium | 2026-11-13 | Not applicable | No public exploit | Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure. |
| CVE-2026-129157 | Medium | 2026-11-13 | Not applicable | No public exploit | ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details. |
| CVE-2026-129131 | Medium | 2026-11-13 | Not applicable | No public exploit | Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests. |
| CVE-2026-128834 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5. |
| CVE-2026-126448 | Medium | 2026-11-13 | Not applicable | Proof of concept only | OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nn_configure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajax_code.php or add_context.php, which lack ACL and CSRF checks, to tamper with clinical-note templates and assignments. |
| CVE-2026-126447 | Medium | 2026-11-13 | Not applicable | No public exploit | OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications. |
| CVE-2026-126446 | Medium | 2026-11-13 | Not applicable | No public exploit | OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve destroyed-drug records because destroyed_drugs_report.php lacks the admin/drugs or inventory/reporting ACL check. Attackers can submit the report refresh form with a chosen date range to obtain drug names, NDC, lots, quantities, destruction methods, witnesses, and notes. |
| CVE-2026-126445 | Medium | 2026-11-13 | Not applicable | No public exploit | OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim tracker_id to patient_tracker_status.php or drug_screen_completed.php to falsify check-in status, rooms, drug-screen completion, and tracker history. |
| CVE-2026-126444 | Medium | 2026-11-13 | Not applicable | Proof of concept only | OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy data in the vendor XML and trigger eRx synchronization state changes. |
| CVE-2026-126439 | Medium | 2026-11-13 | Not applicable | No public exploit | OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers. |
| CVE-2026-126422 | Medium | 2026-11-13 | Not applicable | No public exploit | OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient_id and type values to falsely record "None known" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations. |
| CVE-2026-126420 | Medium | 2026-11-13 | Not applicable | Proof of concept only | OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form_create request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records. |
| CVE-2026-126419 | Medium | 2026-11-13 | Not applicable | No public exploit | OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and encounterId values to sign and lock any patient's clinical form, creating unauthorized approval records and blocking normal editing. |
| CVE-2026-126413 | Medium | 2026-11-13 | Not applicable | No public exploit | Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence. |
| CVE-2026-126411 | Medium | 2026-11-13 | Not applicable | No public exploit | Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees. |
| CVE-2026-126373 | Medium | 2026-11-13 | Not applicable | No public exploit | Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post_id, language_id, and created_at timestamp to retrieve private unpublished drafts, because the revision() action lacks the admin_id ownership restriction. |
| CVE-2026-125858 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CleverReach® WP: from n/a through 1.5.26. |
| CVE-2026-125853 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15. |
| CVE-2026-125834 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4. |
| CVE-2026-125827 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.31.0. |
| CVE-2026-125825 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1236. |
| CVE-2026-125819 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6. |
| CVE-2026-125810 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. |
| CVE-2026-125808 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8. |
| CVE-2026-125792 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8. |
| CVE-2026-124409 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21. |
| CVE-2026-121776 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20. |
| CVE-2026-116453 | Medium | 2026-11-13 | Not applicable | No public exploit | Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access. |
| CVE-2026-116438 | Medium | 2026-11-13 | Not applicable | No public exploit | Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0 , contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. |
| CVE-2026-116433 | Medium | 2026-11-13 | Not applicable | No public exploit | Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. |
| CVE-2026-116427 | Medium | 2026-11-13 | Not applicable | No public exploit | Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. |
| CVE-2026-116425 | Medium | 2026-11-13 | Not applicable | No public exploit | Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access. |
| CVE-2026-116424 | Medium | 2026-11-13 | Not applicable | No public exploit | Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains Unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access. |
| CVE-2026-112830 | Medium | 2026-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25. |
| CVE-2026-110330 | Medium | 2026-11-13 | Not applicable | No public exploit | A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This allows a local attacker to read environment variables and related metadata of other users' or root processes when abrtd is running. |
| CVE-2026-81559 | Medium | 2026-11-12 | Not applicable | No public exploit | A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files. |
| CVE-2026-81558 | Medium | 2026-11-12 | Not applicable | No public exploit | A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files. |
| CVE-2026-19833 | Medium | 2026-11-12 | Not applicable | No public exploit | A missing authorization vulnerability in the ACL API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files. |
| CVE-2026-19414 | Medium | 2026-11-12 | Not applicable | No public exploit | A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files. |
| CVE-2026-127207 | Medium | 2026-11-12 | Not applicable | Proof of concept only | Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller. Attackers can call these wp_ajax_ handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760. |
| CVE-2026-126642 | Medium | 2026-11-12 | Not applicable | No public exploit | An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential use_role when assigning the single-valued webhook_credential foreign key: JobTemplateAccess.can_add/can_change and WorkflowJobTemplateAccess.can_change in awx/main/access.py omit the check_related('webhook_credential', Credential, ..., role_field='use_role') call that UnifiedCredentialsMixin.can_attach performs for the normal many-to-many credentials relationship, and the serializer validates only the credential's type and namespace. A user who may administer their own job template (or workflow job template) and use its project and inventory can therefore attach a webhook token credential (for example a GitLab token) that they do not have use permission on. The template administrator can retrieve the template's webhook key; a subsequent webhook event causes AWX to decrypt the attached token and send it in the request header (for GitLab, PRIVATE-TOKEN) to a status URL derived from the event payload, disclosing the victim's token to a destination the attacker can influence. This may disclose another user's personal access token and allow whatever actions that token permits. |
| CVE-2026-125787 | Medium | 2026-11-12 | Not applicable | No public exploit | Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0. |
| CVE-2026-120471 | Medium | 2026-11-12 | Not applicable | No public exploit | Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected. |
| CVE-2026-120470 | Medium | 2026-11-12 | Not applicable | No public exploit | Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience. |
| CVE-2026-120146 | Medium | 2026-11-12 | Not applicable | No public exploit | Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. |
| CVE-2026-116327 | Medium | 2026-11-12 | Not applicable | No public exploit | Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. |
| CVE-2026-116311 | Medium | 2026-11-12 | Not applicable | No public exploit | Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. |
| CVE-2026-106027 | Medium | 2026-11-12 | Not applicable | No public exploit | The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed. |
| CVE-2026-14242 | Medium | 2026-11-11 | Not applicable | No public exploit | A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization). |
| CVE-2026-126855 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126809 | Medium | 2026-11-11 | Not applicable | No public exploit | WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter. |
| CVE-2026-126545 | Medium | 2026-11-11 | Not applicable | Proof of concept only | WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing. |
| CVE-2026-125782 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPress Podcasting: from n/a through 11.18.2. |
| CVE-2026-125776 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6. |
| CVE-2026-125763 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0. |
| CVE-2026-125448 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.31. |
| CVE-2026-125444 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through 51.1.87. |
| CVE-2026-125439 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0. |
| CVE-2026-125438 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235. |
| CVE-2026-125437 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.13.0. |
| CVE-2026-125436 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Post Grid: from n/a through 7.9.9. |
| CVE-2026-125434 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235. |
| CVE-2026-125431 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Food Menu – Restaurant Menu & Online Ordering for WooCommerce: from n/a through 6.0.7. |
| CVE-2026-125046 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1. |
| CVE-2026-124753 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. |
| CVE-2026-124421 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in BdThemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through 2.8.2. |
| CVE-2026-124417 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. |
| CVE-2026-124416 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. |
| CVE-2026-124413 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4. |
| CVE-2026-124408 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22. |
| CVE-2026-124271 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3. |
| CVE-2026-124269 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0. |
| CVE-2026-124261 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.7. |
| CVE-2026-123703 | Medium | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request. |
| CVE-2026-123702 | Medium | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline. |
| CVE-2026-123701 | Medium | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall. |
| CVE-2026-123699 | Medium | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16, and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site. |
| CVE-2026-123698 | Medium | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve its full settings, including configured secret keys and the hidden login URL. |
| CVE-2026-123661 | Medium | 2026-11-11 | Not applicable | No public exploit | The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role. |
| CVE-2026-123657 | Medium | 2026-11-11 | Not applicable | No public exploit | The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them. |
| CVE-2026-123481 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2. |
| CVE-2026-122671 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through 1.32.65. |
| CVE-2026-121574 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20. |
| CVE-2026-121014 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. |
| CVE-2026-119303 | Medium | 2026-11-11 | Not applicable | No public exploit | The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server. |
| CVE-2026-119302 | Medium | 2026-11-11 | Not applicable | Working exploit published | The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request. |
| CVE-2026-119032 | Medium | 2026-11-11 | Not applicable | No public exploit | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta. |
| CVE-2026-116468 | Medium | 2026-11-11 | No exploit published | No public exploit | A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm. |
| CVE-2026-115600 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3. |
| CVE-2026-96133 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| CVE-2026-89128 | Medium | 2026-11-10 | Not applicable | No public exploit | Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected. |
| CVE-2026-125652 | Medium | 2026-11-10 | No exploit published | No public exploit | A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier. |
| CVE-2026-125378 | Medium | 2026-11-10 | Not applicable | Proof of concept only | PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it. |
| CVE-2026-121191 | Medium | 2026-11-10 | Not applicable | No public exploit | Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects eta-remote: from 0.0.2 before 0.0.3. |
| CVE-2026-120286 | Medium | 2026-11-10 | Not applicable | Proof of concept only | Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member. A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to. This issue affects nerves_hub: from 1.0.0 before 2.5.3. |
| CVE-2026-119852 | Medium | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119396 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Remote Access API allows an authorized attacker to perform tampering locally. |
| CVE-2026-113822 | Medium | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-113773 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows DHCP Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-112977 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper privilege management in Windows Deployment Services allows an authorized attacker to disclose information locally. |