共收录 4228 条相关情报。
← 返回所有主题CVE-2026-49741
Backend users with write access to the form_definition database table were able to directly create, update, or delete fo
CVE-2026-47352
Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission
CVE-2026-47351
Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission ch
CVE-2026-47350
Backend users were able to move records to a different page without having edit permissions on the source page. This iss
CVE-2026-47349
Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they w
CVE-2026-47346
Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .F
CVE-2026-47343
Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on fold
CVE-2026-11607
Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, whi
CVE-2026-4058
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP
CVE-2026-4986
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before
CVE-2026-26236
A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vul
CVE-2026-44750
SAP MDG (Review Match Groups Application) does not perform the necessary authorization checks for authenticated users. T
CVE-2026-44754
The Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC) are missing c
CVE-2026-44751
Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker t
CVE-2026-44754
该漏洞存在于 SAP ODP-RFC 组件的 RFC 模块中。由于缺乏对调用者身份的验证，允许非授权的客户或第三方应用程序调用这些模块，从而可能访问不应公开的数据。漏洞的 CVSS 评分为 6.6（中等），攻击向量为网络，攻击复杂度高，需要
CVE-2026-44751
该漏洞存在于SAP ABAP应用服务器中，由于未对已认证用户执行必要的授权检查，攻击者能够利用该缺陷执行报告生成命令，进而覆盖其他用户的数据，实现权限提升。该漏洞影响应用程序的完整性（高影响），对可用性影响较低，对机密性无影响。CVSS评分
CVE-2026-44750
SAP MDG（主数据治理）中的Review Match Groups应用程序存在授权检查缺失漏洞。经过身份验证的低权限用户能够绕过权限限制，执行本应受限的操作，导致权限提升。该漏洞仅对完整性产生低影响，不影响机密性和可用性。CVSS评分为
CVE-2026-47724
The `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself adm
CVE-2026-47721
## Summary An authorization issue in the Scheduler API allowed authenticated non-admin users to create or modify schedu
CVE-2026-10787
Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user t