CWE-862
11,680 CVEs • Abstraction: Class • Likelihood of Exploit: High
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVEs (11,680)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. |
Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. |
1Apple 5Ipados Iphone OsMacos+2 moreAug 17, 2026 Jul 27, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An authorization issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. An app may be able to add con...Show more |
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker may be able to determine the legacy VNC password configured for Screen Shari...Show more |
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is li...Show more |
Unauthenticated Broken Access Control in Gillion <= 4.13 versions. |
Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. |
Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions. |
Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions. |
Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions. |
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. |
Subscriber Broken Access Control in FundEngine <= 1.7.8 versions. |
Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions. |
Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. |
Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. |
Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. |
Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. |
Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. |
1Progress 5Connection Manager For Objectscale* Ecs Connection ManagerLoadmaster+2 moreAug 11, 2026 Jul 27, 2026 N/A· v4 8.0 HIGH· v3 N/A· v2 A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform...Show more |
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unau...Show more |