共收录 1909 条相关情报。
← 返回所有主题CVE-2026-79990
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing th
CVE-2026-14326
The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through it
CVE-2026-84796 · CVE-2026-79990
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing th
CVE-2026-84796
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fai
CVE-2026-84771
Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.
CVE-2026-79990 · CVE-2026-84796
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fai
CVE-2026-81428
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when s
CVE-2026-81198
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum
CVE-2026-81196
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question
CVE-2026-81194
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retriev
CVE-2026-77788
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the ob
CVE-2026-77785
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the spe
CVE-2026-77784
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modif
CVE-2026-77783
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front en
CVE-2026-77764
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowi
CVE-2026-15232
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check whe
CVE-2026-82968
A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social
CVE-2026-82968
A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social
CVE-2026-81846
An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an
CVE-2026-84205
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against