Total
11567 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-53346 | 2026-07-22 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in ThimPress Thim Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thim Core: from n/a through 2.3.3. | |||||
| CVE-2026-9234 | 2026-07-22 | N/A | 4.3 MEDIUM | ||
| The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1. This is due to missing capability checks and nonce verification on the admin_post_settings_save_woo-jtl-connector action (handled by JtlConnectorAdmin::save()) and on the wp_ajax_downloadJTLLogs and wp_ajax_clearJTLLogs AJAX actions (handled by the global downloadJTLLogs() and clearJTLLogs() functions). This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings, download a ZIP archive of the connector's developer log files, and delete those log files. | |||||
| CVE-2026-1372 | 2026-07-22 | N/A | 4.3 MEDIUM | ||
| The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization. | |||||
| CVE-2026-63758 | 1 Surrealdb | 1 Surrealdb | 2026-07-22 | N/A | 5.4 MEDIUM |
| SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification. | |||||
| CVE-2026-45285 | 1 Nextcloud | 1 Nextcloud Server | 2026-07-22 | N/A | 6.4 MEDIUM |
| Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member (a person added via email address who does not have a Nextcloud account), the system automatically creates a public link for that external member. This public link is not displayed in the share section of the folder, so the folder owner has no knowledge of its existence. It is sent via email to the external member. It grants the same permissions (read, write, delete, reshare, download) as the Team’s access. An attacker who receives or intercepts this link can access, modify, delete, reshare, and download all data in the shared folder without any further authentication. The folder owner cannot see or revoke the link through the normal sharing interface. This issue has been patched in versions 32.0.9 and 33.0.3. | |||||
| CVE-2025-26418 | 1 Google | 1 Android | 2026-07-22 | N/A | 7.8 HIGH |
| In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-8382 | 2026-07-22 | N/A | 5.3 MEDIUM | ||
| The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request. | |||||
| CVE-2026-40543 | 2026-07-22 | N/A | N/A | ||
| SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information. This issue affects SOPlanning version 1.55 and below. | |||||
| CVE-2026-42675 | 2026-07-22 | N/A | 7.3 HIGH | ||
| Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41. | |||||
| CVE-2026-42677 | 2026-07-22 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in Ben Balter WP Document Revisions allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Document Revisions: from n/a before 4.0.0. | |||||
| CVE-2026-45267 | 2026-07-22 | N/A | 6.5 MEDIUM | ||
| Nextcloud is an open source content collaboration platform. Prior to version 5.2.6, a missing permissions check allowed users to request reading form submissions of other users. This issue has been patched in version 5.2.6. | |||||
| CVE-2026-42671 | 2026-07-22 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GeoDirectory: from n/a through 2.8.157. | |||||
| CVE-2026-42682 | 2026-07-22 | N/A | 9.1 CRITICAL | ||
| Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpForo Forum: from n/a through 3.0.6. | |||||
| CVE-2026-47125 | 2026-07-22 | N/A | 8.8 HIGH | ||
| Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin authorization check. Any authenticated non-admin user can call this endpoint with their bearer token or API key and overwrite the global environment variables that are merged into every project deployment. By overriding values like REGISTRY, IMAGE, DATABASE_URL, or SECRET_KEY that other users reference via ${VAR} in compose files, an attacker can redirect image pulls to attacker-controlled registries (supply-chain RCE on the Docker host), exfiltrate database credentials, or disrupt all projects. This vulnerability is fixed in 1.19.2. | |||||
| CVE-2026-49385 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts | |||||
| CVE-2026-47745 | 2026-07-22 | N/A | 6.5 MEDIUM | ||
| Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0. | |||||
| CVE-2026-49367 | 1 Jetbrains | 1 Intellij Idea | 2026-07-22 | N/A | 8.0 HIGH |
| In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account | |||||
| CVE-2026-49374 | 1 Jetbrains | 1 Teamcity | 2026-07-22 | N/A | 7.6 HIGH |
| In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters | |||||
| CVE-2026-47742 | 2026-07-22 | N/A | 6.5 MEDIUM | ||
| Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO metadata, shipping dimensions, and attached media without holding edit_products. The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client. This vulnerability is fixed in 2.8.0. | |||||
| CVE-2026-49378 | 1 Jetbrains | 1 Teamcity | 2026-07-22 | N/A | 4.3 MEDIUM |
| In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion | |||||