The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up...
CVE-2026-6222
The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1.
#cwe-862
共收录 4283 条相关情报。
← 返回所有主题The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.6.10.6. This is due to a flawed authorization logi...
CVE-2026-4807
The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and inclu
The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the `processRequest()` method in `Formina...
CVE-2026-6222
The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1.
Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI
CVE-2026-42083
### Summary PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handle
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening
## Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-
OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered queued outbound med...
CVE-2026-43583
OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media re
OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser pre...
CVE-2026-43580
OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigat
OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profi...
CVE-2026-43579
OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that
OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers can pivot into th...
CVE-2026-43577
OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through brows
OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credential...
CVE-2026-43575
OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmve_S...
CVE-2026-5753
CVE-2026-5753 影响 WordPress 的 All-in-One WP Migration Unlimited Extension 插件（版本 ≤ 2.83）。该插件存在授权缺失漏洞，具体位于 'Ai1wmve_Schedul
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce A...
CVE-2026-3208
该漏洞存在于WordPress的Mercado Pago支付插件中，影响版本直至并包括8.7.11。由于WooCommerce的'mp_pix_image' API端点缺少权限检查，未经身份验证的攻击者能够检索任意订单的PIX支付二维码图像
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
CVE-2026-43885
### Summary An unauthenticated user can read `APISecret` from `objects/plugins.json.php` and use it to call protected
Kubewarden vulnerable to RBAC Reconnaissance via unchecked can_i host capability call
CVE-2026-42541
### Impact Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to
Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collection...
CVE-2026-33420
Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_det
OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation...
CVE-2026-43573
OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser
OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks....
CVE-2026-43572
OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO in
OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming settings. Attackers...
CVE-2026-43568
OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators
OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exp...
CVE-2026-43567
OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that byp
OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured ...
CVE-2026-42439
OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action