Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-66155 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Questionar for Elementor questionar-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Questionar for Elementor: from n/a through <= 1.1.7. | |||||
| CVE-2025-66150 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Appender appender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appender: from n/a through <= 1.1.1. | |||||
| CVE-2025-66151 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Countdowner for Elementor countdowner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Countdowner for Elementor: from n/a through <= 1.0.4. | |||||
| CVE-2025-66149 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove UnGrabber ungrabber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnGrabber: from n/a through <= 3.1.3. | |||||
| CVE-2025-66159 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Walker for Elementor walker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Walker for Elementor: from n/a through <= 1.1.6. | |||||
| CVE-2025-63038 | 2026-09-23 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.40. | |||||
| CVE-2025-66156 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through <= 1.0.9. | |||||
| CVE-2025-66146 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Logger for Elementor: from n/a through <= 1.0.9. | |||||
| CVE-2025-66157 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Sliper for Elementor sliper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sliper for Elementor: from n/a through <= 1.0.10. | |||||
| CVE-2025-66158 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Gmaper for Elementor gmaper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmaper for Elementor: from n/a through <= 1.0.9. | |||||
| CVE-2025-66144 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for Elementor: from n/a through <= 1.0.10. | |||||
| CVE-2025-66148 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Conformer for Elementor conformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conformer for Elementor: from n/a through <= 1.0.7. | |||||
| CVE-2026-73014 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-23 | N/A | 7.8 HIGH |
| Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-92456 | 2026-09-23 | N/A | 7.1 HIGH | ||
| yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment. | |||||
| CVE-2026-92460 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers without proper permission checks. | |||||
| CVE-2026-92455 | 2026-09-23 | N/A | 4.3 MEDIUM | ||
| yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST /admin-api/crm/customer/send-mail with arbitrary customerIds, templateCode, and templateParams to deliver unauthorized messages through the organization's SMS and email channels. | |||||
| CVE-2026-92461 | 2026-09-23 | N/A | 4.3 MEDIUM | ||
| yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal information including login names, nicknames, departments, email addresses, mobile numbers and last login IP addresses. | |||||
| CVE-2026-92457 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify invoice status, inflate contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary addresses. | |||||
| CVE-2026-92458 | 2026-09-23 | N/A | 4.3 MEDIUM | ||
| yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to withdraw entire product catalogs from sale or re-enable withdrawn products without proper permission checks. | |||||
| CVE-2026-84835 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: from n/a through 2.1.5. | |||||