Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft OctoCloud allows...
CVE-2025-0640
Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft OctoCloud allows Resource Leak Exposure. Thi
#cwe-639
共收录 1946 条相关情报。
← 返回所有主题The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress...
CVE-2026-7665
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Informa
The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object...
CVE-2026-8611
The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions
The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account...
CVE-2026-9851
The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, a
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass...
CVE-2026-8839
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key i
The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability...
CVE-2026-9851
The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, a
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due ...
CVE-2026-8839
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key i
The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'invoice_id' paramete...
CVE-2026-8611
The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4...
CVE-2026-7665
该漏洞存在于WordPress插件Essential Addons for Elementor（流行模板与小部件）所有版本至6.6.4（含）中。通过ajax_load_more函数，由于对可包含的文章限制不足，未认证攻击者能够利用信息泄露漏
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More...
CVE-2026-10038
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vul
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorizati...
CVE-2026-10038
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vul
Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
CVE-2026-47716
### Description Bugsink’s issue list supports bulk actions such as resolving or muting selected issues. In affected vers
Bugsink: Issue event views can show an event from another project if its UUID is known
CVE-2026-47715
### Description Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
CVE-2026-47743
## Impact Three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and sto
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated user...
CVE-2026-46390
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath e...
CVE-2026-45750
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix co...
CVE-2026-45746
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to version 2.3.2 do not v...
CVE-2026-45743
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-ma
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
CVE-2026-47419
## Summary **Type:** Insecure Direct Object Reference. The agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{wor
NocoDB: Missing Ownership Check in MCP Attachment Read
CVE-2026-47388
### Summary A low-privilege MCP token holder with knowledge of an attachment path could read any file in shared storage,