Export limit exceeded: 16977 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,977

Export CSV
CVE-2026-14349

TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themetechmount Wordpress-extensions
Products
Truebooker Truebooker
CVE-2026-87860

Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Subscriptions For Woocommerce
CVE-2026-10609

Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cluster Logging Operator Logging Logging Subsystem For Red Hat Openshift
CVE-2026-124628

LDAP Identity Validation Flaw Enables Privilege Escalation in Octopus Server

In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Octopus
Products
Octopus Server
CVE-2026-124627

LDAP Misconfiguration Enables Unauthorized Team Memberships in Octopus Server

In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Octopus
Products
Octopus Server
CVE-2026-82002

Media Encoder | Incorrect Authorization (CWE-863)

Media Encoder is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Media Encoder
CVE-2026-124269

WordPress Happy Addons for Elementor plugin <= 3.51.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress-extensions
Products
Happy Addons For Elementor Happy Addons For Elementor
CVE-2026-125659

Information Disclosure Vulnerability in eMudhra emBridge

This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API. Successful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system. The vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs.

CVSS 4.0 · 2.1 Low EPSS n/a KEV · Not listed
Vendors
Emudhra
Products
Embridge
CVE-2026-112182

Multiple Vulnerabilities in OpenKM Community Edition

Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Openkm
Products
Openkm Community Edition
CVE-2026-94125

Apache Storm: Supervisor page discloses worker placement of other users' topologies

Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Storm
CVE-2026-126281

NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy

NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126283

NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens

NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126375

Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait

Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126402

Fleet before 4.89.0 Broken Access Control via User Administration API

Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy software and execute scripts on those teams' hosts.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Fleetdm
Products
Fleet
CVE-2026-126403

Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint

Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Coder
Products
Coder
CVE-2026-126444

OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy data in the vendor XML and trigger eRx synchronization state changes.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-127077

OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-128031

OpenMage magento-lts before 20.18.2 Incorrect Authorization in Admin Controllers ACL

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-128052

OpenMage magento-lts before 20.19.0 Block Whitelist Bypass via {{layout}} Directive

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-124408

WordPress WPCafe plugin <= 3.0.22 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Arraytics Wordpress-extensions
Products
Wpcafe Wpcafe