Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,978

Export CSV
CVE-2026-75867

Broken Access Control

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central
CVE-2026-75864

Broken Access Control

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.

CVSS 3.1 · 8.1 High EPSS 1.0% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central
CVE-2026-118531

Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-13764

Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by setting the `stm_developer_access_token` transient and using the developer access auto-login flow to obtain administrator session cookies.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-127016

MISP Modules Website: Missing Authorization on External Tool Management Endpoints

The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Misp
Products
Misp-modules
CVE-2026-126642

Awx: webhook credential assignment omits use_role check, exposing another user's token

An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential use_role when assigning the single-valued webhook_credential foreign key: JobTemplateAccess.can_add/can_change and WorkflowJobTemplateAccess.can_change in awx/main/access.py omit the check_related('webhook_credential', Credential, ..., role_field='use_role') call that UnifiedCredentialsMixin.can_attach performs for the normal many-to-many credentials relationship, and the serializer validates only the credential's type and namespace. A user who may administer their own job template (or workflow job template) and use its project and inventory can therefore attach a webhook token credential (for example a GitLab token) that they do not have use permission on. The template administrator can retrieve the template's webhook key; a subsequent webhook event causes AWX to decrypt the attached token and send it in the request header (for GitLab, PRIVATE-TOKEN) to a status URL derived from the event payload, disclosing the victim's token to a destination the attacker can influence. This may disclose another user's personal access token and allow whatever actions that token permits.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform
CVE-2026-96834

WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Retrieve Embedded Sensitive Data.This issue affects GiveWP: from n/a through 4.16.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-12591

Privilege Escalation

Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.

CVSS 3.1 · 9.9 Critical EPSS 1.7% KEV · Not listed
Vendors
Zohocorp
Products
M365 Manager Plus
CVE-2026-87772

Unauthenticated Polkit Privilege Escalation in TÜBİTAK BİLGEM's Pardus About

Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation. This issue affects Pardus About: before 1.2.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-76878

aodh: python-watcher: aodh / python-watcher: cross-project alarm enumeration and webhook missing authorization

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key and skips the branch that normally restricts results to the caller's project. A non-admin user with the reader role can list alarms from all projects, exposing alarm actions containing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. The parameter can also be combined with a foreign project_id to target a specific project's alarms. A related concern is that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit's webhook URL, for example from this leaked Aodh alarm metadata, can start an EVENT audit and its associated action plan regardless of their own project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release (Watcher 4.0.0).

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Aodh
CVE-2026-114162

Microsoft Graph Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Privileged Management