Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
CVE-2026-54356
### Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obta
#cwe-862
共收录 4122 条相关情报。
← 返回所有主题The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions...
CVE-2026-18431
CVE-2026-18431 是一个影响 WordPress 生态的高危漏洞，涉及 Avada 主题（≤7.16）与 Fusion Builder 插件（≤3.16）的联合使用。该漏洞被归类为任意文件写入，根因在于这两款组件在授权检查和输入
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users t...
CVE-2026-77694
CVE-2026-77694 是 WordPress 的 Eventin 插件（版本 < 4.1.19）中存在的一个安全漏洞。该插件用于活动管理和票务销售。漏洞的根源在于插件对访客结账令牌（guest checkout token）的授权范
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anony...
CVE-2026-75798
The AI Engine WordPress 插件在 3.7.2 之前的版本中存在一个安全漏洞。该插件的一个管理专用功能（administration-only feature）在执行授权检查时存在缺失，而是依赖于一个分发给匿名访问者的令
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a...
CVE-2026-74928
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing
The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, a...
CVE-2026-14550
The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through i
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supp...
CVE-2026-13406
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before r
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated ...
CVE-2026-13172
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/r...
CVE-2026-80191
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated use
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image...
CVE-2026-16645
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Bro
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue...
CVE-2026-15916
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versi
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScr...
CVE-2026-16645
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Bro
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from ...
CVE-2026-15916
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versi
TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that do...
CVE-2026-62861
TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another work
Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed...
CVE-2026-79286
Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to po
Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arbitrary code outside the sandbox via ...
CVE-2026-79286
Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to po
Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to...
CVE-2026-79212
Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised
Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security se...
CVE-2026-79208
Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive infor
Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a cra...
CVE-2026-79184
Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised t
Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via UI Interact...
CVE-2026-79154
Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social en