Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-72681 | 1 Elastic | 1 Kibana | 2026-09-03 | N/A | 6.5 MEDIUM |
| Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read. | |||||
| CVE-2026-85304 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.17. | |||||
| CVE-2026-84779 | 2026-09-03 | N/A | 8.1 HIGH | ||
| Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions. | |||||
| CVE-2026-84757 | 2026-09-03 | N/A | 8.2 HIGH | ||
| Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. | |||||
| CVE-2026-84755 | 2026-09-03 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions. | |||||
| CVE-2026-84215 | 2026-09-03 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions. | |||||
| CVE-2026-17563 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers. | |||||
| CVE-2026-81427 | 2026-09-03 | N/A | 4.3 MEDIUM | ||
| The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email. | |||||
| CVE-2026-77787 | 2026-09-03 | N/A | 2.7 LOW | ||
| The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users. | |||||
| CVE-2026-74927 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications. | |||||
| CVE-2026-14215 | 2026-09-03 | N/A | 6.5 MEDIUM | ||
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier. | |||||
| CVE-2026-17613 | 2026-09-03 | N/A | 7.5 HIGH | ||
| Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning. | |||||
| CVE-2026-78069 | 2026-09-03 | N/A | N/A | ||
| Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreControllerApps`'s `appTask` delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of `fof.xml`'s wildcard-deny resolving under the singularised ACL key `app`, which has no explicit allow rule — not because of any deliberate check. Behind that path, `applocalizationdata::getInstallerTool()` used a caller-influenced table name with no allow-list, both to select a `#__j2store_*` table for truncation and to build a path to SQL files it then executes — a path-traversal-capable file read/execute. | |||||
| CVE-2026-84660 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job. | |||||
| CVE-2026-84674 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2026-84661 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job. | |||||
| CVE-2026-84323 | 1 Google | 1 Chrome | 2026-09-03 | N/A | 5.3 MEDIUM |
| Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-84328 | 1 Google | 1 Chrome | 2026-09-03 | N/A | 3.1 LOW |
| Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-78601 | 1 Elastic | 1 Kibana | 2026-09-03 | N/A | 5.5 MEDIUM |
| Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output. | |||||
| CVE-2026-18544 | 1 Ibm | 1 Portieris | 2026-09-02 | N/A | 8.1 HIGH |
| IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references. | |||||