Export limit exceeded: 12013 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,013

Export CSV
CVE-2026-119525

WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Desk Dropshipping XML for WooCommerce dropshipping-xml-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dropshipping XML for WooCommerce: from n/a through 1.7.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wp Desk
Products
Dropshipping Xml For Woocommerce Dropshipping Xml For Woocommerce
CVE-2026-123148

WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tms Wordpress-extensions
Products
Ivyforms Ivyforms
CVE-2026-119513

WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ahmad Wordpress-extensions
Products
Js Help Desk Js Help Desk
CVE-2026-123462

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-122660

WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bakkbone Australia Wordpress-extensions
Products
Floristpress Floristpress
CVE-2026-106027

Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Oxygen Mydata For Woocommerce
CVE-2026-121668

Azure Confidential Clean Rooms Tampering Vulnerability

Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Confidential Clean Room
CVE-2026-121574

WordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpchill
Products
Passster Passster
CVE-2026-88176

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-125431

WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Food Menu – Restaurant Menu & Online Ordering for WooCommerce: from n/a through 6.0.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125046

WordPress Create plugin <= 3.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-120805

Authorization bypass via redirected FLE2 state-collection writes in encrypted CRUD path

In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. The server’s authorization layer validated only the user-facing target collection namespace, while subsequent internal writes derived from client-supplied parameters were performed with elevated internal privileges, bypassing the original caller’s permission scope. This could allow unauthorized writes into another collection’s Queryable Encryption metadata, potentially corrupting encrypted index state and compaction operations.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120823

Missing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration Data

A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120825

Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access

An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-118408

Apache Roller: Unpublished entries of other weblogs readable through preview

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Roller
CVE-2026-105440

Switch Engine (EXOS) JSON-RPC Authorization Bypass Allows Read-Only Users to Disclose Sensitive Information

Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosure of sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device. This issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11. Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Extreme Networks Extremenetworks
Products
Switch Engine (exos) Switch Engine (exos)
CVE-2026-123481

WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—