Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs
CVE-2026-108730
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py
#cwe-862
共收录 3939 条相关情报。
← 返回所有主题EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes
CVE-2026-108727
EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows
GLPI through 12.0.0 Missing Authorization via ajax/map.php
CVE-2026-108726
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privile
phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages
CVE-2026-108720
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to vi
Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration
CVE-2026-108718
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authoriz
Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController
CVE-2026-108717
Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows aut
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate
CVE-2026-108713
SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point
CVE-2026-108712
SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to...
CVE-2026-94235
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions,
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admi...
CVE-2026-89283
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bul
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress ...
CVE-2026-86717
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allo
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, al...
CVE-2026-86706
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actio
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitr...
CVE-2026-85121
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allo
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure...
CVE-2026-84254
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure ...
CVE-2026-84253
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when u
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that t...
CVE-2026-84252
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updatin
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure th...
CVE-2026-84251
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when upd
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthent...
CVE-2026-106029
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleti
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary p...
CVE-2026-104682
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feat
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because...
CVE-2026-108708
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every ca