The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for...
CVE-2026-18441
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to I
#cwe-639
共收录 1909 条相关情报。
← 返回所有主题Authorization bypass through user-controlled key in Microsoft Container Registry allows an...
CVE-2026-69865
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elev
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an...
CVE-2026-18441
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to I
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69865
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elev
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in ...
CVE-2026-54671
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource arra
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initiali...
CVE-2026-54239
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertex
FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope
CVE-2026-54239
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertex
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email a...
CVE-2026-82685
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
CVE-2026-73999
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
CVE-2026-66575
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowin...
CVE-2026-87829
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate t
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated ...
CVE-2026-91016
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allo...
CVE-2026-91008
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the...
CVE-2026-92588
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endp
In AVideo through 29.0, the API get_api_video endpoint contains a broken access control...
CVE-2026-92577
In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization (`get_obj...
CVE-2026-61596
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRunt...
CVE-2026-61589
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths...
CVE-2026-92588
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endp
In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos with ow...
CVE-2026-92577
In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client...
CVE-2026-61592
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to