共收录 4228 条相关情报。
← 返回所有主题CVE-2025-26418
In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when
CVE-2026-45285
Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before
CVE-2026-45267
Nextcloud is an open source content collaboration platform. Prior to version 5.2.6, a missing permissions check allowed
CVE-2026-42677
Missing Authorization vulnerability in Ben Balter WP Document Revisions allows Exploiting Incorrectly Configured Access
CVE-2026-42675
Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Se
CVE-2026-42671
Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Securi
CVE-2026-42682
Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Sec
CVE-2026-47412
## Summary **Type:** Authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint
CVE-2026-47413
## Summary **Type:** Privilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members
CVE-2026-47411
## Summary **Type:** Authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{wor
CVE-2026-47429
### Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the net
CVE-2026-48119
#### Summary Nezha accepts service-monitor `TaskResult` messages from an authenticated agent based only on whether the
CVE-2026-41014
The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization
CVE-2026-40543
SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query bac
CVE-2026-8382
The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and
CVE-2026-8382
Advanced Custom Fields (ACF) 插件是 WordPress 上广泛使用的自定义字段管理插件。本漏洞影响所有版本至 6.8.1（含）。漏洞成因是插件未充分验证用户是否拥有执行操作的权限，导致未认证的攻击者能够通过向
CVE-2026-47416
## Summary **Type:** Vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint i
CVE-2026-47409
## Summary **Type:** Authorization bypass enabling owner lockout. The `DELETE /workspaces/{workspace_id}/members/{user_
CVE-2026-47405
### Summary PraisonAI Platform has a broken workspace authorization check that allows any authenticated low-privilege w
CVE-2026-48169
### Summary The PraisonAI Platform API has two authorization failures that together break workspace isolation. The serv