Search Vulnerabilities

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege E...

SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

Suna < 0.9.102 Broken Access Control via Message Queue API

Apache HBase: Missing scanner instance owner check in thrift delegation service

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authentic...

EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action

Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Se...

Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Param...

Azure DNS Elevation of Privilege Vulnerability

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal

CyberPanel Missing Authorization in cancelBackupCreation Handler

Grav API Plugin before 1.0.10 Broken Access Control

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability

WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability

WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability

WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability

WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability