2026

Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Acc

Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access C

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kiban

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who su

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenti

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Acc

Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrect

Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded

Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting I

Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEO

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templa

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Bo

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Th

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is th

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.

Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.

Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.

Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.

Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.

Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.

Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.

Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.

Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.

Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify even

MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a us

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection strin

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a lengt

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusua

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google

Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to rea

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet co

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauth

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widge

MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The t

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from ma

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registere

CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allo

A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::upload

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a fai

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor wh