OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the final browser ...

CVE-2026-42436

OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab rou

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level au...

CVE-2026-42433

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to a

历史摘要 · 未重新核验 · NVD

The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `embed_form_action()` functio...

CVE-2026-3601

The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a miss

历史摘要 · 未重新核验 · NVD

The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `Live_Action::reset()` function...

CVE-2026-4362

The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missin

历史摘要 · 未重新核验 · NVD

The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing attacker-controlle...

CVE-2026-5294

The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This

历史摘要 · 未重新核验 · NVD

phpVMS has an /importer authorization bypass causing full database wipe

CVE-2026-42569

# Security Advisory: Unauthenticated Access to Legacy Import Feature **Severity:** Critical **Affected versions:** phpV

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration

## Summary The `GET /api/station/{station_id}/file/{id}/play` endpoint, handled by `PlayAction`, is missing the `Middle

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption

## Summary The `/api/internal/{station_id}/liquidsoap/{action}` endpoint is accessible from the public web interface be

历史摘要 · 未重新核验 · GitHub Advisory

Argo has Missing Authorization in its Sync ConfigMap Provider

CVE-2026-42297

### Summary The Sync Service's ConfigMap-backed provider (`server/sync/sync_cm.go`) performs **zero authorization checks

历史摘要 · 未重新核验 · GitHub Advisory

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /chat WebSocket endpoint used by the Chat Trigger node's Hosted Chat feat...

CVE-2026-42228

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /chat WebSocket

历史摘要 · 未重新核验 · NVD

n8n is an open source workflow automation platform. Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify whether the authenticated caller ...

CVE-2026-42226

n8n is an open source workflow automation platform. Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters e

历史摘要 · 未重新核验 · NVD

Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved. ...

CVE-2026-42809

Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effectiv

历史摘要 · 未重新核验 · NVD

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and...

CVE-2026-4100

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhoo

历史摘要 · 未重新核验 · GitHub Advisory

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6...

CVE-2026-4100

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhoo

历史摘要 · 未重新核验 · NVD

The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of...

CVE-2026-4024

The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing

历史摘要 · 未重新核验 · GitHub Advisory

The FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in...

CVE-2026-4650

The FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and incl

历史摘要 · 未重新核验 · GitHub Advisory

The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wpr_update_form_action_meta` AJA...

CVE-2026-4024

The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing

历史摘要 · 未重新核验 · NVD

The FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.0.8. This is due to missing authorization and non...

CVE-2026-4650

The FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and incl

历史摘要 · 未重新核验 · NVD

The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing...

CVE-2026-6963

The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the w

历史摘要 · 未重新核验 · GitHub Advisory

The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wmg_save_provider_config AJAX action in all versions up to...

CVE-2026-6963

The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the w

历史摘要 · 未重新核验 · NVD