A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which c...

CVE-2026-9789

CVE-2026-9789 是一个影响 Acer NitroSense 软件（版本低于 3.01.3052）的本地权限提升（LPE）漏洞。漏洞源于 PSAdminAgent 服务，该服务创建了一个具有弱访问控制列表（ACL）的命名管道。任何

历史摘要 · 未重新核验 · NVD

Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user documents in CouchDB b...

CVE-2026-46424

Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/publ

历史摘要 · 未重新核验 · NVD

Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, allowing any user ...

CVE-2026-45716

Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected

历史摘要 · 未重新核验 · NVD

Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in...

CVE-2026-48926

Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allow

历史摘要 · 未重新核验 · GitHub Advisory

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method...

CVE-2026-48923

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation

历史摘要 · 未重新核验 · GitHub Advisory

Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate c...

CVE-2026-48926

Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allow

历史摘要 · 未重新核验 · NVD

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to conn...

CVE-2026-48923

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation

历史摘要 · 未重新核验 · NVD

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth(...

CVE-2026-8787

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to,

历史摘要 · 未重新核验 · NVD

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7,...

CVE-2025-43306

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Ta

历史摘要 · 未重新核验 · GitHub Advisory

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able to gain root privileges.

CVE-2025-43306

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Ta

历史摘要 · 未重新核验 · NVD

Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

CVE-2026-46716

Nezha监控系统存在一个严重的权限绕过漏洞（CVE-2026-46716）。该组件是一个开源的服务器监控和运维管理平台，支持管理员（RoleAdmin）和普通成员（RoleMember）两种角色。漏洞位于定时任务相关的API端点（POST

历史摘要 · 未重新核验 · GitHub Advisory

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable...

CVE-2026-9018

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation

历史摘要 · 未重新核验 · GitHub Advisory

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via the `easy...

CVE-2026-9018

WordPress插件Easy Elements for Elementor（所有版本至1.4.5）存在权限提升漏洞。插件的`easyel_handle_register()`函数通过`wp_ajax_nopriv_eel_register

历史摘要 · 未重新核验 · NVD

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and...

CVE-2026-8327

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass

历史摘要 · 未重新核验 · GitHub Advisory

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw ...

CVE-2026-8327

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass

历史摘要 · 未重新核验 · NVD

@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies

Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the adm

历史摘要 · 未重新核验 · GitHub Advisory

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled '...

CVE-2026-5118

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2

历史摘要 · 未重新核验 · NVD

In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected. In...

CVE-2026-45254

In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key

历史摘要 · 未重新核验 · NVD

phpMyFAQ: IDOR Account Takeover

### Summary An Insecure Direct Object Reference (IDOR) vulnerability in phpMyFAQ's Admin API allows any authenticated ad

历史摘要 · 未重新核验 · GitHub Advisory

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable...

CVE-2026-7284

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation

历史摘要 · 未重新核验 · GitHub Advisory