Export limit exceeded: 12053 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 12017 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,017

Export CSV
CVE-2026-76209

phpMyFAQ before v4.1.6 Registration Bypass via API

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-76211

phpMyFAQ before 4.1.7 Information Disclosure via Admin API

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics by calling these endpoints with a valid session.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-50152

Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ceph
Products
Ceph
CVE-2026-24369

WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Theme-one Wordpress
Products
The Grid Wordpress
CVE-2026-24368

WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2026-75798

AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ai Engine Project Wordpress
Products
Ai Engine Wordpress
CVE-2026-18431

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themefusion Wordpress
Products
Avada | Website Builder For Wordpress & Woocommerce Fusion Builder Wordpress
CVE-2026-19197

Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-77507

Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations that permit anonymous access, this metadata can be retrieved without any authentication. The exposed information can include project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links, though translated-string content is not included in the feed. Installations using private projects or restricted components are affected. This issue is fixed in version 2026.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Weblate
Products
Weblate
CVE-2026-18965

Missing Authorization in PayRange API

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Payrange
Products
Payrange
CVE-2026-81346

Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dynamiapps Wordpress
Products
Frontend Admin By Dynamiapps Wordpress
CVE-2026-18233

MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-18234

MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-82475

iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Iflytek
Products
Astron-agent
CVE-2026-82544

wger-project wger Password Reset gym.py reset_user_password cross-site request forgery

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This patch is called 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314. It is advisable to implement a patch to correct this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wger-project
Products
Wger
CVE-2026-19616

Information Disclosure in TBC Technology's KitLogistic

Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tbc Technology
Products
Kitlogistic