ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and r...

CVE-2026-108506

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-pa

历史摘要 · 未重新核验 · NVD

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.

CVE-2026-108505

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by sy

历史摘要 · 未重新核验 · NVD

ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method ...

CVE-2026-108504

ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framew

历史摘要 · 未重新核验 · NVD

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.

CVE-2026-108502

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant

历史摘要 · 未重新核验 · NVD

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password res...

CVE-2026-94257

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone numb

历史摘要 · 未重新核验 · NVD

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `creat...

CVE-2026-92975

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation i

历史摘要 · 未重新核验 · NVD

The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. ...

CVE-2026-77183

The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via accoun

历史摘要 · 未重新核验 · NVD

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,...

CVE-2026-104766

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to P

历史摘要 · 未重新核验 · NVD

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a...

CVE-2026-104725

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation i

历史摘要 · 未重新核验 · NVD

ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking ...

CVE-2026-108501

ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and r

历史摘要 · 未重新核验 · NVD

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX h...

CVE-2026-107645

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.5

历史摘要 · 未重新核验 · NVD

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is...

CVE-2026-104022

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege E

历史摘要 · 未重新核验 · GitHub Advisory

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. Th...

CVE-2026-104022

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege E

历史摘要 · 未重新核验 · NVD

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/aut...

CVE-2026-57458

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oau

历史摘要 · 未重新核验 · NVD

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2...

## Description ### Summary In Vikunja v2.6.0 the project-permission engine resolves a user's effective permission on a

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

CVE-2026-57458

## Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal

历史摘要 · 未重新核验 · GitHub Advisory

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys...

CVE-2025-14123

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5

历史摘要 · 未重新核验 · NVD

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have...

CVE-2026-93548

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user

历史摘要 · 未重新核验 · NVD

IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privileged local user could exploit this vulnerability to gain...

CVE-2026-84245

IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privi

历史摘要 · 未重新核验 · NVD

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — th...

CVE-2026-93017

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API

来源摘录 · NVD