grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the...
CVE-2026-86195
grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where t
#cwe-269
共收录 809 条相关情报。
← 返回所有主题grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super fla...
CVE-2026-86195
grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where t
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation...
CVE-2026-81543
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability...
CVE-2026-81543
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
CVE-2026-73842
### Summary The OpenChoreo control-plane cluster-gateway exposes internal management APIs (`/api/proxy/`, `/api/exec/`,
CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)
CVE-2026-75857
### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.
CVE-2026-75160
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API K...
CVE-2026-85514
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st
A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_provided of the file st2api/st2api/cont...
CVE-2026-85513
A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_us
StackStorm st2 API Key auth.py privileges management
CVE-2026-85514
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st
StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management
CVE-2026-85513
A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_us
The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()...
CVE-2026-15354
The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator sess...
CVE-2026-85154
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-r
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.
CVE-2026-84830
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated adminis
WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash
CVE-2026-85154
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-r
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactiv...
CVE-2026-84795
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactiva
Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
CVE-2026-84795
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactiva
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a su...
CVE-2026-81583
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site sig
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers,...
CVE-2026-80467
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its fr
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrat...
CVE-2026-19453
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves acr