Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108
CVE-2026-81269
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field version
#cwe-862
共收录 4122 条相关情报。
← 返回所有主题Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109
CVE-2026-81166
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Dig
Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114
CVE-2026-81164
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF version
Missing Authorization vulnerability in DimaFreund Rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rentsyst: from n/a throug...
CVE-2026-84835
Missing Authorization vulnerability in DimaFreund Rentsyst allows Exploiting Incorrectly Configured Access Control Secur
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although...
CVE-2026-84805
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authen...
CVE-2026-84802
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::action
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint pas...
CVE-2026-84801
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and tar...
CVE-2026-84800
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionR
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with c...
CVE-2026-84798
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permi...
CVE-2026-84797
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate()
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can mo...
CVE-2026-84794
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied.
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries int...
CVE-2026-84792
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements end
Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.
CVE-2026-84760
Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.
Missing Authorization vulnerability in Mamunur Rashid Classified Listing allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Classified Listing:...
CVE-2026-84217
Missing Authorization vulnerability in Mamunur Rashid Classified Listing allows Accessing Functionality Not Properly Con
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.
CVE-2026-82223
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.
Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
CVE-2026-84805
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
CVE-2026-84802
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::action
Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
CVE-2026-84801
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-
Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file
CVE-2026-84800
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionR
Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
CVE-2026-84798
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::