Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate
CVE-2026-84797
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate()
#cwe-862
共收录 4122 条相关情报。
← 返回所有主题Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
CVE-2026-84794
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied.
Craft CMS before 5.10.11 Broken Access Control via element-indexes
CVE-2026-84792
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements end
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authe...
CVE-2026-81427
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment st
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifie...
CVE-2026-77787
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve ve...
CVE-2026-74927
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API list
The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce v...
CVE-2026-14357
The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action c...
CVE-2026-14215
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a val
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController...
CVE-2026-84715
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allow
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission...
CVE-2026-84715
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allow
FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update
CVE-2026-84715
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allow
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote...
CVE-2026-84328
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote...
CVE-2026-84323
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a ...
CVE-2026-84328
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering t...
CVE-2026-84323
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise
A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job...
CVE-2026-84470
A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bul
A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested instance_groups w...
CVE-2026-84470
A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bul
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM ...
CVE-2026-78608
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authori
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference e...
CVE-2026-78607
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Pri
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated u...
CVE-2026-78603
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Acces