#cwe-269

共收录 809 条相关情报。

漏洞预警2026-10-31 发布MEDIUM

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component A...

CVE-2026-120185

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the fi

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-266 #cwe-269 #severity:medium

漏洞预警2026-10-31 发布HIGH

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privile...

CVE-2026-120070

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-269 #severity:high

漏洞预警2026-10-31 发布HIGH

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and i...

CVE-2026-104012

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Es

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-269 #severity:high

漏洞预警2026-10-31 发布HIGH

The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This mak...

CVE-2026-120040

The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, a

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-269 #severity:high

漏洞预警2026-10-30 发布HIGH

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges...

CVE-2026-63339

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authentica

来源摘录 · NVD

#cve #cwe-20 #cwe-269

漏洞预警2026-10-30 发布HIGH

Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a conte...

CVE-2026-62990

Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1

来源摘录 · NVD

#cve #cwe-269 #cwe-79

漏洞预警2026-10-30 发布INFO

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an auth...

CVE-2026-61850

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authori

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-30 发布HIGH

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7...

CVE-2026-118205

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privile

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-30 发布HIGH

The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including,...

CVE-2026-105894

The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to P

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-30 发布HIGH

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially explo...

CVE-2026-101213

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low priv

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-30 发布MEDIUM

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized...

CVE-2026-59386

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper p

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-29 发布CRITICAL

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplie...

CVE-2026-113616

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved accou

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-28 发布HIGH

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1....

CVE-2026-86393

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-28 发布MEDIUM

The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach...

CVE-2026-76780

The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-28 发布HIGH

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() functio...

CVE-2026-109381

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 T

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-28 发布HIGH

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress...

CVE-2026-111577

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configu

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-27 发布HIGH

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_e...

CVE-2026-58255

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrat

来源摘录 · NVD

#cve #cwe-269 #cwe-862 #cwe-915

漏洞预警2026-10-27 发布INFO

App passwords were allowed to bypass password confirmation on sensitive endpoints.

CVE-2026-77172

App passwords were allowed to bypass password confirmation on sensitive endpoints.

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-27 发布INFO

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with lo...

CVE-2026-111584

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to ver

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-27 发布INFO

Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Manag...

CVE-2026-111583

Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.8

历史摘要 · 未重新核验 · NVD

#cve #cwe-269