Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,516

Export CSV
CVE-2026-0844

Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field

The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
N-media Wordpress
Products
Simple User Registration Wordpress
CVE-2026-24302

Azure Arc Elevation of Privilege Vulnerability

Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.6 High EPSS 1.5% KEV · Not listed
Vendors
Microsoft
Products
Azure Arc
CVE-2026-24300

Azure Front Door Elevation of Privilege Vulnerability

Azure Front Door Elevation of Privilege Vulnerability

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Microsoft
Products
Azure Front Door
CVE-2026-21238

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS 3.3% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more
CVE-2026-2592

Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update

The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to validate that the authority token provided in the callback URL belongs to the specific order being marked as paid. This makes it possible for unauthenticated attackers to potentially mark orders as paid without proper payment by reusing a valid authority token from a different transaction of the same amount.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Zarinpal
Products
Wordpress Zarinpal Gateway
CVE-2026-21535

Microsoft Teams Information Disclosure Vulnerability

Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Teams
CVE-2026-2768

Sandbox escape in the Storage: IndexedDB component

Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Firefox Esr Thunderbird
CVE-2026-31272

Super Administrator Creation Without Authentication in MRCMS 3.1.2

MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper authorization validation, enabling direct addition of super administrator accounts without authentication.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mrcms Wuweiit
Products
Mrcms Mushroom
CVE-2026-5881

chromium-browser: Policy bypass in LocalNetworkAccess

Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-39942

Directus has a Path Traversal and Broken Access Control in File Management API

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as uploaded_by to obscure the tampering. This vulnerability is fixed in 11.17.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Directus Monospace
Products
Directus Directus
CVE-2026-4432

YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR

The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Yithemes
Products
Wordpress Yith Woocommerce Wishlist
CVE-2025-15433

Shared Files < 1.7.58 - Contributor+ Arbitrary File Download

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sharedfilespro Wordpress
Products
Shared Files Wordpress
CVE-2023-30582

nodejs: fs.watchFile bypass in experimental permission model

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nodejs
Products
Nodejs
CVE-2025-66223

OpenObserve's Invite Token Lifecycle Misconfiguration

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issued links remain valid simultaneously. This results in broken access control where a removed or demoted user can regain access or escalate privileges. This issue has been patched in version 0.16.0.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Openobserve
Products
Openobserve
CVE-2025-6592

Creating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog

Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Abusefilter
CVE-2025-64347

Apollo Router Improperly Enforces Renamed Access Control Directives

Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls. This issue is fixed in versions 1.61.12 and 2.8.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apollographql
Products
Apollo-router
CVE-2025-62713

Kottster app reinitialization can be re-triggered allowing command injection in development mode

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Kottster
Products
Kottster