共收录 4167 条相关情报。
← 返回所有主题CVE-2026-79672
Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access toke
CVE-2026-79669
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read a
CVE-2026-79666
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated us
CVE-2026-79665
Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireSc
CVE-2026-75908
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. T
CVE-2026-17587
The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass i
CVE-2026-79652
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat
CVE-2026-77146
The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-exi
CVE-2026-77143
The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modi
CVE-2026-77142
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for c
CVE-2026-77141
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and
CVE-2026-77140
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in
CVE-2026-77133
The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the prof
CVE-2026-77128
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user
CVE-2026-56092
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requ
CVE-2026-17548
Missing authorization in Checkmk <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who
CVE-2026-66109
A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is explo
CVE-2026-78467
The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a
CVE-2026-75930
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all ve
CVE-2026-19892
The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to