773 PoCs | 119 CISA KEV

tag

Missing-Authorization

YayMail WooCommerce Plugin Missing Authorization to Privilege Escalation — CVE-2026-1937

CVE-2026-1937 web Unverified

CVE-2026-1937webHIGH 7.2Unverified2026-07-05YAMCS Unauthorized User Enumeration via IAM API (CVE-2026-44595)

CVE-2026-44595 / GHSA-p2rj-mrmc-9w29 web Patched

CVE-2026-44595 / GHSA-p2rj-mrmc-9w29webMEDIUM 4.3Patched2026-07-05XWiki Unauthenticated XAR Import Leading to RCE — CVE-2026-33137

CVE-2026-33137 web Patched

CVE-2026-33137webCRITICAL 9.3Patched2026-07-05WordPress HT Mega (Absolute Addons for Elementor) Unauthenticated PII Disclosure (CVE-2026-4106)

CVE-2026-4106 web Unverified

CVE-2026-4106webHIGHUnverified2026-07-05WordPress Download Manager 3.3.5.2 — Unauthenticated IDOR (CVE-2026-39676)

CVE-2026-39676 web Unverified

CVE-2026-39676webMEDIUMUnverified2026-07-05User Registration & Membership for WordPress — Unauthenticated Admin Approval Bypass (CVE-2026-6145)

CVE-2026-6145 web Unverified

CVE-2026-6145webMEDIUM 5.3Unverified2026-07-05Simple File List Plugin Unauthenticated File Modification / Path Traversal — CVE-2026-11912

CVE-2026-11912 web Patched

CVE-2026-11912webHIGH 7.5Patched2026-07-05JoomCCK Unauthenticated SQL Injection via `tags.save` (CVE-2026-49048)

CVE-2026-49048 (Advisory ID JOOMCCK-2026-001) web Unpatched

CVE-2026-49048webCRITICAL 8.7Unpatched2026-07-05AutoGPT Platform Chat Session IDOR / Session Hijack — CVE-2026-30950

CVE-2026-30950 (GHSA-q58p-v9r9-7gqj) web Patched

CVE-2026-30950webHIGH 7.1Patched2026-07-05