Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,012

Export CSV
CVE-2026-87792

Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Developers Italia Wordpress-extensions
Products
Design-scuole-wordpress-theme Design-scuole-wordpress-theme
CVE-2026-14349

TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themetechmount Wordpress-extensions
Products
Truebooker Truebooker
CVE-2026-87860

Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Subscriptions For Woocommerce
CVE-2026-10609

Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cluster Logging Operator Logging Logging Subsystem For Red Hat Openshift
CVE-2026-124269

WordPress Happy Addons for Elementor plugin <= 3.51.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress-extensions
Products
Happy Addons For Elementor Happy Addons For Elementor
CVE-2026-125659

Information Disclosure Vulnerability in eMudhra emBridge

This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API. Successful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system. The vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs.

CVSS 4.0 · 2.1 Low EPSS n/a KEV · Not listed
Vendors
Emudhra
Products
Embridge
CVE-2026-112182

Multiple Vulnerabilities in OpenKM Community Edition

Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Openkm
Products
Openkm Community Edition
CVE-2026-94125

Apache Storm: Supervisor page discloses worker placement of other users' topologies

Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Storm
CVE-2026-126281

NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy

NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126375

Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait

Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126442

OpenEMR before 8.5.0 Missing Authorization via create_portallogin.php Portal Takeover

OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over portal accounts, read PHI, and lock patients out.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126444

OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy data in the vendor XML and trigger eRx synchronization state changes.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126446

OpenEMR before 8.5.0 Missing Authorization via destroyed_drugs_report.php

OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve destroyed-drug records because destroyed_drugs_report.php lacks the admin/drugs or inventory/reporting ACL check. Attackers can submit the report refresh form with a chosen date range to obtain drug names, NDC, lots, quantities, destruction methods, witnesses, and notes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126447

OpenEMR before 8.5.0 Missing Authorization via trusted-messages-ajax.php Direct Messaging

OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126448

OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers

OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nn_configure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajax_code.php or add_context.php, which lack ACL and CSRF checks, to tamper with clinical-note templates and assignments.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126455

OpenEMR before 8.5.0 Privilege Escalation via Missing Authorization and SQL Injection

OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including users_secure hashes, hijack patient portal identities, and forge approved clinical records.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126457

OpenEMR before 8.5.0 Missing Authorization in InstallerController Module Actions

OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticated user to modify module administration settings without the admin/manage_modules permission. Low-privileged users such as Front Office clerks can POST to saveConfig, DeleteAcl, DeleteHooks and nickName actions to reconfigure or partially disable installed modules.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126458

OpenEMR before 8.5.0 Missing Authorization via authorizations_full.php

OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizations_full.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set authorized=1 on billing, forms, pnotes, and transactions records, bypassing provider review.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126466

OpenEMR before 8.5.0 Missing Authorization in Patient Create and Search Endpoints

OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create patient records and enumerate patients by omitting aclCheckCore() checks. Attackers can POST to new_comprehensive_save.php to create patients with insurance PHI, or query new_search_popup.php and patient_select.php to leak names, SSNs and DOBs.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126468

OpenEMR before 8.5.0 Missing Authorization on Reports and Reminder Endpoints

OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr