共收录 1909 条相关情报。
← 返回所有主题CVE-2026-49464
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, custom
CVE-2026-81916
Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the po
CVE-2026-81915
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::s
CVE-2026-62140
Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.
CVE-2026-62134
Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.
CVE-2026-62113
Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.
CVE-2026-89264
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authe
CVE-2026-89262
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs owner
CVE-2026-89257
AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.js
CVE-2026-89252
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updatin
CVE-2026-82213
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested be
CVE-2026-86782
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing
CVE-2026-82305
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given
CVE-2026-14566
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce chec
CVE-2026-18121
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lightbox endp
CVE-2026-80434
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and
CVE-2026-81210
IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the
CVE-2026-18121
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lightbox endp
CVE-2026-81210
IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the
CVE-2026-80434
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and