Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass
CVE-2026-100670
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The ac
#cwe-639
共收录 1909 条相关情报。
← 返回所有主题Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker
CVE-2026-100614
Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image
Capgo SSO Provider ID Authentication Bypass via Incomplete Migration
CVE-2026-100612
Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table.
Flowise through 3.1.4 Missing Authorization via upsert-history
CVE-2026-100610
Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permis
Flowise through 3.1.4 Insecure Direct Object Reference via Credential
CVE-2026-100609
Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on
Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be...
CVE-2026-97636
Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-co
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of...
CVE-2026-96762
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegmen
A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode...
CVE-2026-84720
A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts databa
A flaw was found in the automation-controller notification subsystem. Although...
CVE-2026-84713
A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.no
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A...
CVE-2026-95602
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploitin
Formie: Missing authorization on sent notification resend modal exposes submission PII
CVE-2026-76089
### Impact The control panel action `formie/sent-notifications/get-resend-modal-content` (`SentNotificationsController:
A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifact...
CVE-2026-84720
A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts databa
A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected ...
CVE-2026-84713
A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.no
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. ...
CVE-2026-95602
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploitin
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
CVE-2026-95592
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
CVE-2026-93623
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
CVE-2026-93513
Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed q...
CVE-2026-90899
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotification...
CVE-2026-76089
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-rese
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a ...
CVE-2026-76087
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submi