Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.3we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to downlo…Oct 14, 2026
- High7.1jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change oth…Oct 14, 2026
- High7.7Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or works…Oct 14, 2026
- High8.7Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or una…Oct 14, 2026
- Medium6.5Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.Th…Oct 14, 2026
- High7.3Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security L…Oct 14, 2026
- Medium6.5The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'je…EPSS 0.3%Oct 14, 2026
- Medium5.3The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as pai…EPSS 0.2%Oct 14, 2026
- Medium5.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing una…EPSS 0.2%Oct 14, 2026
- Medium5.3The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated atta…EPSS 0.2%Oct 14, 2026
- Medium5.3The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting…EPSS 0.2%Oct 14, 2026
- Medium6.5The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning rout…EPSS 0.1%Oct 14, 2026
- Medium5.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, all…EPSS 0.2%Oct 14, 2026
- Medium5.9The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unatta…EPSS 0.2%Oct 14, 2026
- Medium5.3The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result…EPSS 0.2%Oct 14, 2026
- Medium5.3The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated u…EPSS 0.2%Oct 14, 2026
- Medium5.3QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slip…EPSS 0.3%Oct 13, 2026
- Medium6.3Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-fac…EPSS 0.4%Oct 13, 2026
- High7.1Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI p…EPSS 0.4%Oct 13, 2026
- High8.7Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration…EPSS 0.4%Oct 13, 2026
- High8.1The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1.EPSS 0.5%Oct 13, 2026
- High7.5The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly veri…EPSS 0.5%Oct 13, 2026
- High8.8Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.EPSS 0.7%Oct 13, 2026
- High8.8Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.EPSS 0.7%Oct 13, 2026
- Low3.8A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requestsEPSS 0.2%Oct 13, 2026