CWE-862

8,811 vulnerabilities with CWE-862

CVE-2026-57299 MEDIUM

Jenkins Contrast Continuous Application Security Plugin < 3.11 - Unauthenticated Metadata Enumeration

CVSS 4.3

CVE-2026-57297 MEDIUM

Jenkins Contrast Plugin < 3.11 SSRF via Missing Permission Check

CVSS 4.3

CVE-2026-57294 MEDIUM

Jenkins EC2 Fleet Plugin - Missing Authorization

CVSS 5.4

CVE-2026-57293 MEDIUM

Jenkins Gitee Plugin - Missing Authorization

CVSS 4.3

CVE-2026-57291 MEDIUM

Jenkins Gitee Plugin - Missing Authorization

CVSS 5.4

CVE-2026-57286 MEDIUM

Jenkins Git Parameter Plugin < 462.vdcf3df2ed2ca_ - Missing Authorization

CVSS 4.3

CVE-2026-57285 MEDIUM

Jenkins GitHub Branch Source Plugin - Missing Authorization

CVSS 4.3

CVE-2026-7761 HIGH

Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

CVSS 8.8

CVE-2026-9619 MEDIUM

Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action

CVSS 4.3

CVE-2026-9616 MEDIUM

Generate Security.txt <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action

CVSS 4.3

CVE-2026-9184 MEDIUM

24liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action

CVSS 4.3

CVE-2026-9178 HIGH

WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint

CVSS 7.5

CVE-2026-9175 MEDIUM

Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter

CVSS 5.3

CVE-2026-9172 MEDIUM

Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint

CVSS 5.3

CVE-2026-8690 MEDIUM

RentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action

CVSS 5.3

CVE-2026-8688 MEDIUM

Advance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action

CVSS 4.3

CVE-2026-8617 MEDIUM

SearchPlus <= 1.7.1 - Unauthenticated Settings Modification and Deletion

CVSS 5.3

CVE-2026-8614 MEDIUM

Assistio <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_assistio_settings AJAX Action

CVSS 4.3

CVE-2026-7617 MEDIUM

Secufor_OAuth <= 1.0.7 - Missing Authorization to Unauthenticated Account Logout via 'secuforoauth_unregister_action' AJAX Action

CVSS 5.3

CVE-2026-4297 HIGH

Welcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method

CVSS 8.8

CVE-2026-12094 MEDIUM

Advanced Contact Form 7 <= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter

CVSS 5.3

CVE-2026-11807 CRITICAL

Eda-server: websocket missing authorization allows credential theft via activation_id spoofing

CVSS 9.6

CVE-2026-54322 HIGH

Daytona < 0.185.0 - Cross-Organization Role IDOR

CVSS 7.7

CVE-2026-54019 MEDIUM

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

CVSS 6.5

CVE-2026-54012 HIGH

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

CVSS 7.1