CVE-2026-123659
The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those conf
CVSS
5.3
Medium
EPSS
0.3%
p24
KEV
—
Exploit Today
7
0-100
Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-863
Not enough EPSS history yet.
The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-93487—19.8%
——6In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.7hCVE-2026-105948—30.5%
——9In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.7hCVE-2026-1265667.1 HIG33.7%
——10Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded template, removing administrator edit and move protection logged under the administrator's name.12hCVE-2026-1220992.9 LOW12.2%
——4CAI Content Credentials is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.17hCVE-2026-1219138.8 HIG59.1%
——18Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction.4hCVE-2026-1213559.1 CRI57.1%
——17Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction.17h