CVE Intelligence
Início / CVEs

Base de CVEs

Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.

Severidade
Limpar

5.064 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2026-47492 Média · 5.5 CWE-862 30/09/2026
Missing Authorization em NVIDIA GeForce
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service.
CVE-2026-100280 Média · 4.3 CWE-862 30/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
CVE-2026-100271 Baixa · 2.7 CWE-862 30/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
CVE-2026-100269 Média · 4.3 CWE-862 30/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
CVE-2026-100266 Média · 6.5 CWE-862 30/09/2026
Missing Authorization em Jetbrains Hub
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
CVE-2026-97285 Média · 5.4 CWE-862 30/09/2026
WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
CVE-2026-97267 Média · 4.3 CWE-862 30/09/2026
WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
CVE-2026-97247 Média · 6.5 CWE-862 30/09/2026
WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
CVE-2026-97243 Média · 5.4 CWE-862 30/09/2026
WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
CVE-2026-97239 Média · 6.5 CWE-862 30/09/2026
WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.
CVE-2026-97197 Alta · 7.5 CWE-862 30/09/2026
WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
CVE-2026-96834 Média · 6.5 CWE-862 30/09/2026
WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.
CVE-2026-96823 Alta · 7.5 CWE-862 30/09/2026
WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
CVE-2026-96818 Alta · 7.5 CWE-862 30/09/2026
WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.
CVE-2026-96817 Alta · 8.2 CWE-862 30/09/2026
WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.
CVE-2026-96348 Alta · 7.5 CWE-862 30/09/2026
WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
CVE-2026-95587 Alta · 7.5 CWE-862 30/09/2026
WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
CVE-2026-94499 Alta · 7.1 CWE-862 30/09/2026
WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
CVE-2026-94120 Alta · 7.5 CWE-862 30/09/2026
WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
CVE-2026-94074 Média · 6.5 CWE-862 30/09/2026
WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
CVE-2026-96342 Média · 6.9 CWE-862 30/09/2026
WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.
CVE-2026-94297 Baixa · 2.7 CWE-862 30/09/2026
Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.
CVE-2026-93580 Média · 5.3 CWE-862 30/09/2026
InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed.
CVE-2026-85576 Média · 4.3 CWE-862 30/09/2026
All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.
CVE-2026-81841 Média · 5.3 CWE-862 29/09/2026
Paused shared dashboard access tokens still expose data source configuration
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.