共收录 1926 条相关情报。
← 返回所有主题CVE-2026-8155
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints
CVE-2026-15209
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a
CVE-2026-14927
The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership che
CVE-2026-14847
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of i
CVE-2026-14843
The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the target
CVE-2026-12697
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting us
CVE-2026-12376
The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing
CVE-2026-68501
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Syli
CVE-2026-68500
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Syli
CVE-2026-68501
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Syli
CVE-2026-68500
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Syli
CVE-2026-10700
IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API th
CVE-2026-12945
IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs throug
CVE-2025-60931
An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33
CVE-2026-52841
### Summary `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the se
CVE-2026-52837
## Summary The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::inde
CVE-2026-52839
## Summary Easy!Appointments correctly filters provider-scoped appointments in the `appointments/search` response, pro
CVE-2026-5060
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure D
CVE-2026-63242
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to
CVE-2026-63241
An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course compl