CWE-862

8,143 vulnerabilities with CWE-862

CVE-2026-44719 MEDIUM

Mathesar: Missing collaborator checks allowed access to database-scoped Mathesar metadata

CVE-2026-44718 MEDIUM

Mathesar: Missing collaborator checks allowed access to saved explorations in other databases

CVE-2026-2031 CRITICAL

Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.

CVE-2026-7563 MEDIUM

Classified Listing <= 5.3.10 - Subscriber Order Note Authorization Bypass

CVSS 4.3

CVE-2026-4683 MEDIUM

Smartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update

CVSS 6.5

CVE-2026-4094 HIGH

FOX – Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion

CVSS 8.1

CVE-2026-8547 HIGH

Google Chrome < 148.0.7778.168 - Privilege Escalation via Password Policy Bypass

CVSS 7.5

CVE-2026-45371 HIGH

SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

CVE-2026-45147 MEDIUM

SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

CVSS 4.3

CVE-2026-44592 CRITICAL

Gradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning

CVSS 9.4

CVE-2026-41315 CRITICAL

mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS 9.8

CVE-2026-44482 CRITICAL

soundcloud-rpc: Remote Code Execution via XSS in Track Title

CVSS 9.6

CVE-2026-6472 MEDIUM

PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege

CVSS 5.4

CVE-2026-4031 HIGH

Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception

CVSS 7.5

CVE-2026-4030 HIGH

Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion

CVSS 8.1

CVE-2026-4029 HIGH

Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export

CVSS 7.5

CVE-2026-6512 CRITICAL

InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters

CVSS 9.1

CVE-2026-6145 MEDIUM

User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter

CVSS 5.3

CVE-2026-6510 CRITICAL

InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe'

CVSS 9.8

CVE-2026-6506 HIGH

InfusedWoo Pro <= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update

CVSS 8.8

CVE-2026-8144 MEDIUM

Missing Authorization in GitLab

CVSS 4.3

CVE-2026-6883 LOW

Missing Authorization in GitLab

CVSS 2.6

CVE-2026-3829 MEDIUM

WP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering

CVSS 5.4

CVE-2026-2900 LOW

Missing Authorization in GitLab

CVSS 2.7

CVE-2026-7525 MEDIUM

My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter

CVSS 4.3