Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,978

Export CSV
CVE-2026-119525

WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Desk Dropshipping XML for WooCommerce dropshipping-xml-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dropshipping XML for WooCommerce: from n/a through 1.7.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wp Desk
Products
Dropshipping Xml For Woocommerce Dropshipping Xml For Woocommerce
CVE-2026-123148

WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tms Wordpress-extensions
Products
Ivyforms Ivyforms
CVE-2026-119513

WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ahmad Wordpress-extensions
Products
Js Help Desk Js Help Desk
CVE-2026-123462

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-122660

WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bakkbone Australia Wordpress-extensions
Products
Floristpress Floristpress
CVE-2026-106027

Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Oxygen Mydata For Woocommerce
CVE-2026-101542

Oracle Capacity Remote Takeover via HTTP in Oracle E-Business Suite

Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity. Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Capacity E-business Suite
CVE-2026-123391

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-121668

Azure Confidential Clean Rooms Tampering Vulnerability

Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Confidential Clean Room
CVE-2026-120782

Visual Studio Code Security Feature Bypass Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2026-121355

Adobe Connect | Incorrect Authorization (CWE-863)

Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Connect
CVE-2026-121574

WordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpchill
Products
Passster Passster
CVE-2026-96162

Windows Clipboard Virtual Channel Extension Elevation of Privilege Vulnerability

Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more
CVE-2026-88176

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-125431

WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Food Menu – Restaurant Menu & Online Ordering for WooCommerce: from n/a through 6.0.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125046

WordPress Create plugin <= 3.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—