Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did n...

CVE-2026-64662

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Cont

历史摘要 · 未重新核验 · NVD

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId}/staff...

CVE-2026-48088

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · NVD

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance ac...

CVE-2026-48085

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · NVD

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at `/api/tenants/{id}/appoint...

CVE-2026-48077

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · NVD

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the `add-to-tunnel` endpoint creates a new ap...

CVE-2026-48075

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · NVD

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, ...

CVE-2026-47765

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints

历史摘要 · 未重新核验 · NVD

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_logs record-managem...

CVE-2026-45415

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

历史摘要 · 未重新核验 · NVD

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass ...

CVE-2026-13399

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a

历史摘要 · 未重新核验 · NVD

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

`ChartsController::actionGetNewUsersData()` at `/actions/charts/get-new-users-data` is missing a `requirePermission('vie

历史摘要 · 未重新核验 · GitHub Advisory

Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

CVE-2026-70636

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access th

历史摘要 · 未重新核验 · OSV.dev

Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints

CVE-2026-67621

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perf

历史摘要 · 未重新核验 · OSV.dev

OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

CVE-2026-48085

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

Frappe: Lack of Permissions in restore/bulk_restore

CVE-2026-47765

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints

历史摘要 · 未重新核验 · OSV.dev

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

CVE-2026-14793

The `reorder-sets` action in Craft CMS’s `GlobalsController` is missing the `requireAdmin()` check that the adjacent `sa

历史摘要 · 未重新核验 · GitHub Advisory

OpenReception: GET appointment by ID returns full appointment record without authorization

CVE-2026-48077

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections

CVE-2026-48075

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

Decidim: CSV census record endpoints improper authorization

CVE-2026-45415

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.3

历史摘要 · 未重新核验 · OSV.dev

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to anoth...

CVE-2026-18277

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remo

历史摘要 · 未重新核验 · NVD

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observ...

CVE-2026-18276

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated us

历史摘要 · 未重新核验 · NVD

Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.

CVE-2026-66712

Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.

历史摘要 · 未重新核验 · NVD