Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,671

Export CSV
CVE-2026-111689

XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Exrick
Products
Xboot
CVE-2026-111684

Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service

Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Absmach
Products
Magistrala
CVE-2026-111674

Tbed through 20240319 Missing Authorization via setImgFileName Endpoint

Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hello-hao
Products
Tbed
CVE-2026-111614

DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Devlive-community
Products
Datacap
CVE-2026-110213

ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to obtain other users' generated images, videos, and output metadata.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Stonewuu
Products
Ai-fusion-video
CVE-2026-102298

Insufficient Authorization and User Boundary Validation in Omada Controller MSP

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication.  Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Software Controller
CVE-2026-110724

Rate Limiting Bypass via Untrusted X‑Forwarded‑For Header in Eclipse Connected Services Platform API Gateway

In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Connected Services Platform
CVE-2026-103083

WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Elextensions Wordpress-extensions
Products
Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes
CVE-2026-111365

cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Cool-team-official
Products
Cool-admin-midway
CVE-2026-111366

cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Cool-team-official
Products
Cool-admin-midway
CVE-2026-111615

Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gz-yami
Products
Mall4cloud
CVE-2026-112861

WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Xnau Webdesign
Products
Participants Database Participants Database
CVE-2026-111358

SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mettle
Products
Sendportal
CVE-2026-54657

Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openzaak
Products
Open Zaak
CVE-2026-101650

Unauthorized Access and Partial Denial of Service via HTTP in Oracle Partner Management

Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Partner Management
CVE-2026-107789

SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-111596

Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-110902

WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Liquid Web / Stellarwp Wordpress-extensions
Products
Event Tickets Event Tickets
CVE-2026-77937

Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Letta Letta-ai
Products
Letta Letta
CVE-2026-112240

Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Typo3
Products
Extension Typo3 Fluid-form By Coding.ms