Base de CVEs

CVE-2026-57703 Média · 6.3 CWE-862 23/07/2026

WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

CVE-2026-57425 Média · 6.5 CWE-862 23/07/2026

WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.

CVE-2026-57367 Alta · 7.1 CWE-862 23/07/2026

WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

CVE-2026-27423 Média · 4.3 CWE-862 23/07/2026

WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.

CVE-2026-27422 Média · 5.3 CWE-862 23/07/2026

WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.

CVE-2026-27418 Média · 5.3 CWE-862 23/07/2026

WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.

CVE-2026-27399 Média · 5.3 CWE-862 23/07/2026

WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.

CVE-2026-27392 Média · 4.3 CWE-862 23/07/2026

WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

Contributor Broken Access Control in uListing <= 2.2.0 versions.

CVE-2026-27391 Média · 5.4 CWE-862 23/07/2026

WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in uListing <= 2.2.0 versions.

CVE-2026-27377 Média · 6.7 CWE-862 23/07/2026

WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability

Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

CVE-2026-27355 Média · 5.3 CWE-862 23/07/2026

WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

CVE-2026-25466 Média · 5.3 CWE-862 23/07/2026

WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.

CVE-2026-25427 Média · 5.4 CWE-862 23/07/2026

WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in eRoom <= 1.7.1 versions.

CVE-2026-25424 Média · 4.3 CWE-862 23/07/2026

WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.

CVE-2026-15827 Média · 5.3 CWE-862 23/07/2026

GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints

The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are registered with permission_callback => '__return_true', and their callbacks read the site's stored Mailchimp API key from the gutenkit_settings_list option and proxy Mailchimp audience/list, merge-field, interest-category, interest-name, and subscriber-count metadata back to the caller with no login, nonce, or capability check. This makes it possible for unauthenticated attackers to retrieve private Mailchimp audience configuration information from any site that has configured the GutenKit Mailchimp integration.

CVE-2026-15015 Crítica · 9.8 Exploit público CWE-862 23/07/2026

MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full administrator-equivalent access to the plugin's MCP tool surface and all exposed WordPress content, users, and options. This is exploitable by combining the publicly accessible Dynamic Client Registration endpoint, which allows unauthenticated callers to register arbitrary OAuth clients with an attacker-controlled redirect_uri, with the unprotected authorization endpoint to complete the full OAuth flow without any administrator interaction.

CVE-2026-59677 Média · 6.8 CWE-862 23/07/2026

Process Kill Attack Vector in killall() in seunshare

A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10.

CVE-2026-12082 Alta · 7.5 CWE-862 23/07/2026

Praison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure)

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.

CVE-2026-13078 Alta · 7.7 CWE-862 22/07/2026

Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

CVE-2026-7328 Média · 6.8 CWE-862 22/07/2026

Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service

Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific. This issue affects Core Runtime Firmware: 2.1.0.

CVE-2026-65011 Média · 4.3 CWE-862 22/07/2026

Graylog2 Server Missing Permission Check on Event Definition Duplicate

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings by duplicating them.

CVE-2026-16544 Média · 6.5 CWE-862 22/07/2026

Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.

CVE-2026-63262 Média · 4.3 CWE-862 21/07/2026

Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

CVE-2026-63143 Média · 4.3 CWE-862 21/07/2026

Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

CVE-2026-63141 Média · 5.4 CWE-862 21/07/2026

Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.