CWE-862

Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker wh

Unauthenticated Broken Access Control in Motors <= 5.6.80 versions.

Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.

Contributor Broken Access Control in Flatsome <= 3.20.5 versions.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing a

Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authen

Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpo

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve

The Blocks for ACF Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users coul

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint ret

PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE de

Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs version

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs version

Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access

Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Co

Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce additional-product-field

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control

Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocomm

Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocomme

Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configure

Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting

Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Incorrectly Configured

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting In

Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce all

Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploit

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploit

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admi

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use r

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js use

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND

Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role u

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the compone

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation i

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tr

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated tr

Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access

Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callb