共收录 4167 条相关情报。
← 返回所有主题CVE-2026-75027
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8
CVE-2026-53487
Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/ove
CVE-2026-34836
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and a
CVE-2026-33047
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not ass
CVE-2026-31936
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object informat
CVE-2026-76876
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sens
CVE-2026-62283
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 t
CVE-2026-76876
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sens
CVE-2026-75932
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authent
CVE-2026-75932
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authent
CVE-2026-77087
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbit
CVE-2026-77087
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbit
CVE-2026-62940
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another c
CVE-2026-48751
Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restrict
CVE-2026-77767
Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user ho
CVE-2026-66721
Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by def
CVE-2026-50222
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's U
CVE-2026-16962
The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its p
CVE-2026-77391
A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This a
CVE-2026-72843
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/