Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result ...

CVE-2026-75813

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access

历史摘要 · 未重新核验 · NVD

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download...

CVE-2026-75339

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload

历史摘要 · 未重新核验 · NVD

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat (iLink) share-channel endpoints authorize reques...

CVE-2026-68929

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, th

历史摘要 · 未重新核验 · NVD

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or wit...

CVE-2026-18965

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on th

历史摘要 · 未重新核验 · NVD

FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

CVE-2026-68929

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, th

历史摘要 · 未重新核验 · OSV.dev

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only ...

CVE-2026-65931

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu ent

历史摘要 · 未重新核验 · NVD

LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint

CVE-2026-65931

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu ent

历史摘要 · 未重新核验 · OSV.dev

Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose ass...

CVE-2026-81819

Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint a

历史摘要 · 未重新核验 · NVD

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/bui...

CVE-2026-81335

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch

历史摘要 · 未重新核验 · NVD

Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources

CVE-2026-81335

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch

历史摘要 · 未重新核验 · OSV.dev

Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments

CVE-2026-81819

Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint a

历史摘要 · 未重新核验 · OSV.dev

Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.

CVE-2026-81279

Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.

历史摘要 · 未重新核验 · NVD

Subscriber Broken Access Control in Ditty <= 3.1.67 versions.

CVE-2026-81274

Subscriber Broken Access Control in Ditty <= 3.1.67 versions.

历史摘要 · 未重新核验 · NVD

Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.

CVE-2026-81272

Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.

历史摘要 · 未重新核验 · NVD

Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

CVE-2026-27330

Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

历史摘要 · 未重新核验 · NVD

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to ad...

CVE-2026-78137

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthen

历史摘要 · 未重新核验 · NVD

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anony...

CVE-2026-13414

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a

历史摘要 · 未重新核验 · NVD

senaite.core Vulnerable to Eval Injection and Missing Authorization

CVE-2026-54569

### Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable

历史摘要 · 未重新核验 · GitHub Advisory

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

## Summary OpenWISP IPAM is multi-tenant: every `Subnet` belongs to an `organization`, and API access is scoped to the

历史摘要 · 未重新核验 · GitHub Advisory

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

CVE-2026-54523

## Summary In Kyverno v1.18.1, a tenant who can create a `NamespacedMutatingPolicy` in their own namespace can instruct

历史摘要 · 未重新核验 · GitHub Advisory