Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI...
CVE-2026-5163
Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites whic
#cwe-862
共收录 4228 条相关情报。
← 返回所有主题Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for...
CVE-2026-3117
Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing comma
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the...
CVE-2026-3637
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permis
Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of...
CVE-2026-5163
Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites whic
Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing commands in the Gitlab plugin which allows normal users to uni...
CVE-2026-3117
Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing comma
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenti...
CVE-2026-3637
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permis
The Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4 is vulnerable to unauthorized modification of the Feeds for YouTube (YouTube vid...
CVE-2026-1631
The Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4 is vulnerable to unauth
The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is...
CVE-2025-4202
The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized mo
The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t...
CVE-2025-4202
The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized mo
The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all...
CVE-2026-8681
The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includi
The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly verifyi...
CVE-2026-8681
该漏洞影响WordPress Essential Chat Support插件（所有版本 ≤ 1.0.1）。漏洞本质是授权绕过：插件在处理请求时未正确验证用户权限，导致未认证攻击者通过发送包含参数 ecs_reset_settings=1
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, GET /api/v1/memories/ef is accessible without authentication a...
CVE-2026-45667
CVE-2026-45667 是 Open WebUI 中的一个严重漏洞。Open WebUI 是一个自托管的离线人工智能平台，版本 0.8.0 之前，其 GET /api/v1/memories/ef 端点无需身份验证即可访问，并且会调用
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, there is a vulnerability in chat completion API, which allows ...
CVE-2026-45350
Open WebUI 是一个自托管的离线人工智能平台。在 0.8.6 版本之前，其聊天补全 API 存在一个权限检查缺失漏洞。具体来说，API 端点允许用户提供 tool_ids 和 tool_servers 参数，这些参数被中间件用于构建
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, in standard channels (i.e., channels whose channel.type is nei...
CVE-2026-44571
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, in st
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, there's an IDOR in the channels message management system tha...
CVE-2026-44569
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, ther
phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where...
CVE-2026-45007
phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIs
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api...
CVE-2026-46365
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpo
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the tool update endpoint (POST /api/v1/tools/id/{id}/update) i...
CVE-2026-45395
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the t
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user with low privileges can enumerate activ...
CVE-2026-45399
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any a
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /api/generate, /api/embed, /api/embeddings, and /api/show ...
CVE-2026-44563
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /