Total
11531 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-9243 | 2026-10-11 | N/A | 8.1 HIGH | ||
| The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and update_order_status functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access order management functions and modify order status. | |||||
| CVE-2025-60130 | 2026-10-11 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WEDOS Global: from n/a through <= 1.2.2. | |||||
| CVE-2025-60096 | 2026-10-11 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in CodexThemes TheGem (Elementor) thegem-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem (Elementor): from n/a through <= 5.10.5. | |||||
| CVE-2026-106208 | 1 Google | 1 Chrome | 2026-10-11 | N/A | 6.1 MEDIUM |
| Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) | |||||
| CVE-2026-96334 | 2026-10-11 | N/A | 5.6 MEDIUM | ||
| Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7. | |||||
| CVE-2026-95597 | 2026-10-11 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17. | |||||
| CVE-2026-62028 | 2026-10-11 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21. | |||||
| CVE-2026-107419 | 2026-10-11 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2. | |||||
| CVE-2026-79842 | 2026-10-10 | N/A | 9.1 CRITICAL | ||
| An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713 | |||||
| CVE-2026-62128 | 2026-10-10 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21. | |||||
| CVE-2026-105891 | 2026-10-10 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1. | |||||
| CVE-2026-96461 | 2026-10-09 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10. | |||||
| CVE-2026-95589 | 2026-10-09 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1. | |||||
| CVE-2026-62042 | 2026-10-09 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8. | |||||
| CVE-2026-105883 | 2026-10-09 | N/A | 7.1 HIGH | ||
| Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1. | |||||
| CVE-2026-73665 | 1 Sangoma | 1 Freepbx | 2026-10-09 | N/A | 9.8 CRITICAL |
| FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9. | |||||
| CVE-2026-97075 | 2026-10-09 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rocket: from n/a before 3.23.5. | |||||
| CVE-2026-96337 | 2026-10-09 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3. | |||||
| CVE-2026-62041 | 2026-10-09 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through 3.4.1. | |||||
| CVE-2026-106289 | 1 Google | 1 Chrome | 2026-10-09 | N/A | 6.5 MEDIUM |
| Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||