Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,015

Export CSV
CVE-2026-105888

WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Liquid Web / Stellarwp Wordpress-extensions
Products
Event Tickets Event Tickets
CVE-2026-105055

WordPress WP Mailster plugin <= 1.9.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through 1.9.0.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpmailster
Products
Wp Mailster Wp Mailster
CVE-2026-10768

LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Drupal Localgovdrupal
Products
Localgov Workflows Localgov Workflows
CVE-2026-57395

WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themefic Wordpress
Products
Tourfic Wordpress
CVE-2026-57377

WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowAddons: from n/a through <= 1.6.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpxpo
Products
Wordpress Wowaddons
CVE-2026-44770

Missing Authorization check in SAP S/4 HANA (Create Single Payment)

SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys resulting in disclosure of information. This has low impact on confidentiality, with no impact on integrity and availability of the application.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap S/4 Hana (create Single Payment)
CVE-2026-46459

Missing Authorization in ICU Scandinavia Boomerang

ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Icu Scandinavia
Products
Boomerang
CVE-2026-77391

SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Dynamic Input Field Generator Using Html, Css, And Php Dynamic Input Field Generator Using Html Css And Php
CVE-2026-60784

Unauthorized Data Modification via Low-Privilege Party Search Interface in Oracle Trading Community

Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trading Community. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Trading Community accessible data as well as unauthorized access to critical data or complete access to all Oracle Trading Community accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Trading Community
CVE-2026-60982

Oracle US Federal Human Resources Access Control Flaw Allows Unauthorized Data Modification

Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle US Federal Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle US Federal Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle US Federal Human Resources accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
E-business Suite Us Federal Human Resources
CVE-2026-107887

Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107907

MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist

The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-97353

News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-66379

Authenticated users may view private Puppet module metadata

An authenticated user may view private Puppet module metadata without repository read access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jfrog
Products
Artifactory
CVE-2026-65551

WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Soflyy Wordpress
Products
Breakdance Wordpress
CVE-2026-58241

Missing Authorization Check in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard)

SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and operational disruption, leading to a low impact on the integrity and availability of the application with no impact on confidentiality.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Netweaver And Abap Platform (change And Transport System - Customer Transport Integration Wizard
CVE-2026-58244

Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII)

SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker to access the users account information in the application, which could be leveraged to facilitate further attacks against the identified user accounts. This vulnerability results in low impact on confidentiality of the data, with no impact on the integrity and availability

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Manufacturing Integration And Intelligence