Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
CVE-2026-84757
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
#cwe-862
共收录 4122 条相关情报。
← 返回所有主题Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.
CVE-2026-84755
Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.
Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.
CVE-2026-84754
Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
CVE-2026-84238
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
CVE-2026-84215
Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
Unauthenticated file upload via missing authorization on formatter upload endpoint
CVE-2026-63219
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the A
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595...
CVE-2026-55658
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools wit
MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution...
CVE-2026-85226
MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from ma
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authentic...
CVE-2026-85213
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueE
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators a...
CVE-2026-85212
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attack...
CVE-2026-85210
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registere
ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/res...
CVE-2026-84989
ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoint
MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations
CVE-2026-85226
MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from ma
Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints
CVE-2026-85213
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueE
CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check
CVE-2026-85212
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns
Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
CVE-2026-85210
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registere
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreControllerApps`'s `app...
CVE-2026-78069
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
CVE-2026-73843
### Summary The OpenChoreo control-plane **cluster-gateway** served its caller-facing management APIs on the same networ
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow...
CVE-2026-84674
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read per
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and...
CVE-2026-84661
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream bui