In Concrete CMS 9.5.0 and below,  the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading permission...

CVE-2026-7879

In Concrete CMS 9.5.0 and below,  the submit_password() method in concrete/controllers/single_page/download_file.php all

历史摘要 · 未重新核验 · NVD

SQLAdmin: Authorization Bypass on `ajax_lookup`

CVE-2026-46645

### Impact The `ajax_lookup` endpoint in `application.py` bypasses the `is_accessible()` access control check that all

历史摘要 · 未重新核验 · GitHub Advisory

The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due...

CVE-2026-4843

The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability

历史摘要 · 未重新核验 · GitHub Advisory

The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in al...

CVE-2026-4843

The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: from n/a through 1.0.10.

CVE-2026-39593

Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 WOW Styler: from n/...

CVE-2026-27393

Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Sec

历史摘要 · 未重新核验 · NVD

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions prior to 18.1.0-r...

CVE-2026-33137

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform

历史摘要 · 未重新核验 · NVD

phpMyFAQ: IDOR Account Takeover

### Summary An Insecure Direct Object Reference (IDOR) vulnerability in phpMyFAQ's Admin API allows any authenticated ad

历史摘要 · 未重新核验 · GitHub Advisory

wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None

## Summary GHSA-mhc8-p3jx-84mm (CVE-2026-43948) reported that wger's `reset_user_password` and `gym_permissions_user_ed

历史摘要 · 未重新核验 · GitHub Advisory

The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.  Under certain...

CVE-2026-21836

The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.  Under certain circumstances, documen

历史摘要 · 未重新核验 · GitHub Advisory

Missing Authorization vulnerability in ADD-ONS.ORG PDF for Elementor Forms + Drag And Drop...

CVE-2026-45443

Missing Authorization vulnerability in ADD-ONS.ORG PDF for Elementor Forms + Drag And Drop Template Builder allows Explo

历史摘要 · 未重新核验 · GitHub Advisory

The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.  Under certain circumstances, document level access restrictions will be ignored when determin...

CVE-2026-21836

The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.  Under certain circumstances, documen

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in ADD-ONS.ORG PDF for Elementor Forms + Drag And Drop Template Builder allows Exploiting Incorrectly Configured Access Control Security Leve...

CVE-2026-45443

Missing Authorization vulnerability in ADD-ONS.ORG PDF for Elementor Forms + Drag And Drop Template Builder allows Explo

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects...

CVE-2026-27424

Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Confi

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from...

CVE-2026-27405

Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Contr

历史摘要 · 未重新核验 · NVD

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and...

CVE-2026-5200

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is v

历史摘要 · 未重新核验 · NVD

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update pro...

CVE-2026-44392

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator

历史摘要 · 未重新核验 · NVD

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized...

CVE-2025-15369

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due

历史摘要 · 未重新核验 · GitHub Advisory

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_content_editor ...

CVE-2025-15369

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due

历史摘要 · 未重新核验 · NVD

The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in...

CVE-2026-8610

The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and

历史摘要 · 未重新核验 · GitHub Advisory