Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models...
CVE-2026-111920
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which res
#cwe-269
共收录 809 条相关情报。
← 返回所有主题phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that...
CVE-2026-111909
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated n
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in...
CVE-2026-111893
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRes
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in...
CVE-2026-111890
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUse
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in...
CVE-2026-111891
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API,
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
CVE-2026-96627
## Summary A user holding the delegated `users:update` permission can reset the global administrator's password and take
containerd CRI plugin: Checkpoint restore bypasses destination security context
CVE-2026-95837
### Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
CVE-2026-77524
## Summary A namespace admin who creates a `TriggerAuthentication` and a `ScaledObject` in their own namespace can make
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation...
CVE-2026-104749
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vuln
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is...
CVE-2026-104767
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Esc
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatc...
CVE-2026-85990
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation an
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
CVE-2026-85990
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation an
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109778
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thu
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109756
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, T
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of ...
CVE-2026-109143
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function creden
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to...
CVE-2026-18343
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.
CVE-2026-18343
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request an...
CVE-2026-109667
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creatio
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Websit...
CVE-2024-58390
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certai
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
CVE-2026-18513
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access co