Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
CVE-2026-50554
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauth
#cwe-200
共收录 1721 条相关情报。
← 返回所有主题WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id parameter i...
CVE-2026-85157
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcod...
CVE-2026-85156
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to
WWBN AVideo Broken Access Control via feed/index.php program_id
CVE-2026-85157
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables
WWBN AVideo Broken Access Control via Channel Page
CVE-2026-85156
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
CVE-2026-61842
### Summary The Twig content sandbox replaces `config` with the redacted `SandboxConfig` facade and strips `Config::get
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor`...
CVE-2026-84658
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a construc
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing at...
CVE-2026-84658
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a construc
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthent...
CVE-2026-81199
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before retu
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by ...
CVE-2026-81197
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, al...
CVE-2026-81195
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before retu
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission...
CVE-2026-78151
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stor
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allow...
CVE-2026-77782
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using it
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile...
CVE-2026-19251
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the p
The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected p...
CVE-2026-16983
The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints,
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the...
CVE-2026-16966
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJ
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who...
CVE-2026-84359
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rende
Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote...
CVE-2026-84348
Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak s
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager...
CVE-2026-84481
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration e
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML ...
CVE-2026-84359
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rende