The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability...

CVE-2026-3143

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unau

历史摘要 · 未重新核验 · NVD

Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API

CVE-2026-42137

### TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access or l

历史摘要 · 未重新核验 · GitHub Advisory

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

CVE-2026-42461

### Summary Four `GET` endpoints under `/api/templates*` in Arcane's Huma backend are registered without any `Security`

历史摘要 · 未重新核验 · GitHub Advisory

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes POST /api/char...

CVE-2026-40601

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

历史摘要 · 未重新核验 · NVD

Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items

CVE-2026-41658

## Summary The Admidio inventory module enforces authorization for destructive operations (delete, retire, reinstate) o

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners

## Impact OpenClaw deployments before `2026.4.21` could treat a non-owner sender as authorized for owner-enforced slash

历史摘要 · 未重新核验 · GitHub Advisory

n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay

CVE-2026-42226

## Impact The `dynamic-node-parameters` endpoints did not verify whether the authenticated caller was authorized to use

历史摘要 · 未重新核验 · GitHub Advisory

n8n Vulnerable to Hijacking of Unauthenticated Chat Execution

CVE-2026-42228

## Impact The `/chat` WebSocket endpoint used by the Chat Trigger node's Hosted Chat feature did not verify that an inco

历史摘要 · 未重新核验 · GitHub Advisory

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-spec...

CVE-2026-42522

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers wi

历史摘要 · 未重新核验 · NVD

A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Scri...

CVE-2026-42519

A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overa

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg...

CVE-2026-42648

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrec

历史摘要 · 未重新核验 · GitHub Advisory

Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly...

CVE-2026-42642

Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Sec

历史摘要 · 未重新核验 · GitHub Advisory

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue ...

CVE-2026-42648

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrec

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through ...

CVE-2026-42642

Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Sec

历史摘要 · 未重新核验 · NVD

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data...

CVE-2026-4019

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions

历史摘要 · 未重新核验 · GitHub Advisory

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly...

CVE-2026-42412

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control S

历史摘要 · 未重新核验 · GitHub Advisory

Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting...

CVE-2026-42377

Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Co

历史摘要 · 未重新核验 · GitHub Advisory

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API e...

CVE-2026-4019

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: fro...

CVE-2026-42412

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control S

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms Pro:...

CVE-2026-42377

Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Co

历史摘要 · 未重新核验 · NVD