Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,499

Export CSV
CVE-2026-3121

Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Build Keycloak Build Of Keycloak and 5 more
CVE-2025-67953

WordPress Booking Activities plugin <= 1.16.44 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Booking Activities: from n/a through <= 1.16.44.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-9937

elunez eladmin LocalStorageController deleteFile improper authorization

A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be exploited.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Elunez
Products
Eladmin
CVE-2025-9151

LiuYuYang01 ThriveX-Blog web updateJsonValueByName improper authorization

A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /web_config/json/name/web. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Thrivex
Products
Blog
CVE-2025-8758

TRENDnet TEW-822DRE vsftpd least privilege violation

A vulnerability was found in TRENDnet TEW-822DRE FW103B02. It has been classified as problematic. This affects an unknown part of the component vsftpd. The manipulation leads to least privilege violation. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Trendnet
Products
Tew-822dre
CVE-2025-8757

TRENDnet TV-IP110WN Embedded Boa Web Server boa.conf least privilege violation

A vulnerability was found in TRENDnet TV-IP110WN 1.2.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /server/boa.conf of the component Embedded Boa Web Server. The manipulation leads to least privilege violation. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Trendnet
Products
Tv-ip110wn
CVE-2025-7576

Teledyne FLIR FB-Series O/FLIR FH-Series ID Production Tools production.html access control

A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16 and classified as critical. Affected by this issue is some unknown functionality of the file /priv/production/production.html of the component Production Tools. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-7552

Dromara Northstar Path AuthorizationInterceptor.java preHandle access control

A vulnerability was found in Dromara Northstar up to 7.3.5. It has been rated as critical. Affected by this issue is the function preHandle of the file northstar-main/src/main/java/org/dromara/northstar/web/interceptor/AuthorizationInterceptor.java of the component Path Handler. The manipulation of the argument Request leads to improper access controls. The attack may be launched remotely. Upgrading to version 7.3.6 is able to address this issue. The patch is identified as 8d521bbf531de59b09b8629a9cbf667870ad2541. It is recommended to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-69293

WordPress Final User plugin <= 1.2.5 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <= 1.2.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Final User Wordpress
CVE-2025-69292

WordPress WP Membership plugin <= 1.6.4 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Membership: from n/a through <= 1.6.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Wp Membership Wordpress
CVE-2025-69183

WordPress Hospital Doctor Directory plugin <= 1.3.9 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Hospital & Doctor Directory Wordpress
CVE-2025-69182

WordPress Institutions Directory plugin <= 1.3.4 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in e-plugins Institutions Directory institutions-directory allows Privilege Escalation.This issue affects Institutions Directory: from n/a through <= 1.3.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Institutions Directory Wordpress
CVE-2025-68869

WordPress LazyTasks plugin <= 1.2.37 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through <= 1.2.37.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Lazycoders Wordpress
Products
Lazytasks Wordpress
CVE-2025-68027

WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a through <= 1.1.32.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Themefic Wordpress
Products
Hydra Booking Wordpress
CVE-2025-67966

WordPress Lawyer Directory plugin <= 1.3.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: from n/a through <= 1.3.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Lawyer Directory Wordpress
CVE-2025-6531

SIFUSM/MZZYG BD S1 RTSP Live Video Stream Endpoint access control

A vulnerability was found in SIFUSM/MZZYG BD S1 up to 20250611. It has been declared as problematic. This vulnerability affects unknown code of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper access controls. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. This dashcam is distributed by multiple resellers and different names.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-6525

70mai 1S Configuration Config.cgi improper authorization

A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin/Config.cgi?action=set of the component Configuration Handler. The manipulation leads to improper authorization. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
70mai
Products
1s
CVE-2025-64188

WordPress Soledad theme <= 8.6.9 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in PenciDesign Soledad soledad allows Privilege Escalation.This issue affects Soledad: from n/a through <= 8.6.9.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Pencidesign Wordpress
Products
Soledad Wordpress
CVE-2025-6325

WordPress King Addons for Elementor plugin <= 51.1.36 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in KingAddons.com King Addons for Elementor king-addons allows Privilege Escalation.This issue affects King Addons for Elementor: from n/a through <= 51.1.36.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Kingaddons Wordpress
Products
King Addons For Elementor Wordpress
CVE-2025-62034

WordPress Togo theme < 1.0.4 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress