CWE-862: Missing Authorization

The RapidLoad Power-Up for Autoptimize WordPress plugin versions up to 1.7.1 contain a missing capability check in the ajax_deactivate function, allow...

The RapidLoad Power-Up for Autoptimize WordPress plugin versions up to 1.7.1 contain a missing capability check vulnerability in the attach_rule funct...

This vulnerability allows attackers to bypass authorization controls in the WP Cookie Notice plugin for WordPress, potentially accessing administrativ...

The Jenkins OpenTelemetry Plugin vulnerability allows attackers with Overall/Read permission to exfiltrate Jenkins credentials by connecting to attack...

This CVE describes a macOS code-signing downgrade vulnerability that could allow malicious applications to bypass security restrictions and access pro...

The Mattermost Confluence Plugin vulnerability allows attackers to create unauthorized channel subscriptions via API calls. This affects organizations...

The Mattermost Confluence Plugin before version 1.5.0 has an authorization bypass vulnerability where attackers can retrieve channel subscription deta...

This vulnerability allows Guest users in GitLab to view dependency lists of private projects through job artifacts, potentially exposing sensitive pro...

This CVE describes a Missing Authorization vulnerability in the Real 3D FlipBook WordPress plugin that allows attackers to bypass access controls. It ...

This CVE describes a Missing Authorization vulnerability in the Crowdsignal Forms WordPress plugin that allows attackers to bypass access controls. It...

This vulnerability allows unauthenticated attackers to delete arbitrary files uploaded through the Drag and Drop Multiple File Upload for Contact Form...

The rtMedia plugin for WordPress (also used with BuddyPress and bbPress) versions 4.7.0 to 4.7.3 has an information disclosure vulnerability when the ...

The WP Fastest Cache WordPress plugin contains a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users with Subscriber-leve...

CVE-2025-15289 is an improper access controls vulnerability in Tanium Interact that could allow authenticated users to access data or perform actions ...

This vulnerability in GitLab CE/EE allows unauthorized users to edit merge request approval rules under specific conditions. It affects all GitLab ins...

AzuraCast versions 0.23.1 expose an internal API endpoint intended for SFTPgo software to the public HTTP API. An attacker with knowledge of a station...

A privilege escalation vulnerability in MongoDB Server allows users with limited privileges to terminate queries executed by other users, causing deni...

A missing authorization vulnerability in PostgreSQL's CREATE STATISTICS command allows table owners to create statistics objects in any schema, causin...

This CVE describes a missing authorization vulnerability in Wagtail CMS preview endpoints. Authenticated Wagtail admin users can craft form submission...

This vulnerability allows unauthorized users to access functionality intended only for authorized users in the WCFM – Frontend Manager for WooCommer...

This CVE describes an authorization bypass vulnerability in Checkmk monitoring software. Users with 'Use WATO' permission can access the 'Analyze conf...

An authorization bypass vulnerability in FUXA web-based SCADA/HMI software allows unauthenticated remote attackers to modify device tags via WebSocket...

An improper access control vulnerability in ASUS Secure Delete Driver allows local users to create arbitrary files in specified paths by sending speci...

The BlazeMeter Jenkins Plugin before version 4.27 had a missing authorization vulnerability that allowed any user to view sensitive resource lists in ...

This vulnerability allows any authenticated user, even with low privileges, to install arbitrary Composer packages on Mautic installations. This bypas...

An inadequate access control vulnerability in Davantis DFUSION v6.177.7 allows unauthorized actors to access security camera images and videos from al...

This vulnerability allows unauthorized actors to retrieve perspective parameters from security camera settings in Davantis DDFUSION video management s...