共收录 4228 条相关情报。
← 返回所有主题CVE-2026-8688
The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu
CVE-2026-8617
The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, a
CVE-2026-8614
The Assistio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check a
CVE-2026-7617
The Secufor_OAuth plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.7.
CVE-2026-4297
The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and
CVE-2026-12094
The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a mi
CVE-2026-55542
### Impact Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, a
CVE-2026-55483
### Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a no
CVE-2026-50550
### Impact A user who can edit other users could reset a superadmin's 2FA. ### Patches Patched in 8.5.0
CVE-2026-49976
### Impact The CSV user import in update mode bypasses user-edit authorization. A user with only the `import` permission
CVE-2026-49205
Missing Authorization in API CategoryController — CVE-2026-24421 fixed BackupController by adding userHasPermission(Per
CVE-2026-48500
Any schema can contain a file upload form field, so Filament applies Livewire's `WithFileUploads` trait to the Livewire
CVE-2026-48492
### Impact The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into
CVE-2026-11807
A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible
CVE-2026-54012
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open
CVE-2026-54010
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open
CVE-2026-52799
## Summary In Gogs 0.14.1, `GET /attachments/:uuid` returns the raw attachment file **without verifying whether the req
CVE-2026-50137
## Summary The Budibase server route `POST /api/attachments/:datasourceId/url` ([`packages/server/src/api/routes/static
CVE-2026-56280
Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API
CVE-2026-48500
Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5,