cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 100

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 8.8CVE-2026-106040EPSS 0.4%

    Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_…

  2. 6.9CVE-2026-106039EPSS 0.3%

    Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopy…

  3. 7.7CVE-2026-105840EPSS 0.3%

    lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src…

  4. 6.4CVE-2026-105790EPSS 0.5%

    Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while a…

  5. 5.3CVE-2026-105836EPSS 0.3%

    QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign ro…

  6. 7.1CVE-2026-105834EPSS 0.4%

    Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve fil…

  7. 5.1CVE-2026-80327EPSS 0.4%

    An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.…

  8. 7.3CVE-2026-95526EPSS 0.2%

    Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

  9. 8.8CVE-2026-62072EPSS 0.3%

    Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

  10. 7.5CVE-2026-48199EPSS 0.4%

    Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.

  11. 7.5CVE-2026-42638EPSS 0.2%

    Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.

  12. 6.5CVE-2026-42637EPSS 0.3%

    Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

  13. 7.5CVE-2026-42413EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.

  14. 7.5CVE-2026-41562EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.

  15. 7.5CVE-2026-41561EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.

  16. 7.5CVE-2026-41560EPSS 0.3%

    Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.

  17. 7.5CVE-2026-41559EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup &amp; Restore <= 2.1.2 versions.

  18. 6.5CVE-2026-39798EPSS 0.2%

    Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.

  19. 7.5CVE-2026-39796EPSS 0.3%

    Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.

  20. 7.5CVE-2026-39794EPSS 0.4%

    Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.

  21. 8.6CVE-2026-39792EPSS 0.3%

    Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

  22. 5.3CVE-2026-39791EPSS 0.2%

    Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.

  23. 6.5CVE-2026-39787EPSS 0.3%

    Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.

  24. 6.5CVE-2026-39762EPSS 0.3%

    Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for …

  25. 6.5CVE-2026-39756EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.

  26. 6.5CVE-2026-39754EPSS 0.3%

    Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.

  27. 7.7CVE-2026-39752EPSS 0.4%

    Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.

  28. 7.5CVE-2026-39751EPSS 0.3%

    Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

  29. 6.5CVE-2026-39749EPSS 0.2%

    Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.

  30. 7.1CVE-2026-39730EPSS 0.3%

    Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

  31. 7.2CVE-2026-39729EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.

  32. 7.2CVE-2026-39728EPSS 0.2%

    Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

  33. 7.2CVE-2026-39719EPSS 0.2%

    Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

  34. 7.1CVE-2026-32578EPSS 0.3%

    Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.

  35. 7.1CVE-2026-25433EPSS 0.3%

    Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.

  36. 7.5CVE-2026-105071EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.

  37. 6.5CVE-2026-105059EPSS 0.4%

    Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress…

  38. 7.3CVE-2026-104406EPSS 0.3%

    Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

  39. 6.9CVE-2026-104399EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

  40. 7.2CVE-2026-104387EPSS 0.3%

    Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

  41. 7.5CVE-2026-104385EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

  42. 8.5CVE-2026-102915EPSS 0.2%

    Subscriber Broken Access Control in WPO365 <= 44.1 versions.

  43. 7.5CVE-2026-102387EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

  44. 6.5CVE-2026-94299EPSS 0.2%

    The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change…

  45. 5.5CVE-2026-94278EPSS 0.2%

    The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, in…

  46. 5.3CVE-2026-89289EPSS 0.2%

    The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of…

  47. 5.3CVE-2026-86786EPSS 0.2%

    The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including dra…

  48. 7.8CVE-2026-25267EPSS 0.06%

    Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

  49. 7.5CVE-2026-41563EPSS 0.2%

    Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.

  50. 7.5CVE-2026-39789EPSS 0.2%

    Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.