The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due ...

CVE-2026-104741

The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass i

历史摘要 · 未重新核验 · NVD

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in...

CVE-2026-89301

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to ins

历史摘要 · 未重新核验 · NVD

The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not properly verifying that a us...

CVE-2026-5727

The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. T

历史摘要 · 未重新核验 · NVD

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is...

CVE-2026-104915

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorizati

历史摘要 · 未重新核验 · GitHub Advisory

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. Th...

CVE-2026-104915

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorizati

历史摘要 · 未重新核验 · NVD

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContai...

CVE-2026-107850

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview ac

历史摘要 · 未重新核验 · NVD

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

## Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Cross-project task disclosure through subtask expansion

### Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project'

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

### Summary Creating a task relation over CalDAV does not run the `TaskRelation.CanCreate` permission check that the RES

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Improper access control in the preview links module

CVE-2026-107850

`core-bundle/config/services.yaml` registers the preview access voter with the class `Contao\CoreBundle\Security\Voter\D

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

CVE-2026-91985

## Summary A user who has only read permission on a project can call the single link-share read endpoint and receive th

历史摘要 · 未重新核验 · GitHub Advisory

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow...

CVE-2026-108111

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that ex

历史摘要 · 未重新核验 · GitHub Advisory

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows...

CVE-2026-108112

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete ot

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

CVE-2026-107813

## Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session (OTP step-up) requirement added to the nginx, cert

历史摘要 · 未重新核验 · GitHub Advisory

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

CVE-2026-107811

Summary 0xJacky/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credent

历史摘要 · 未重新核验 · GitHub Advisory

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attac...

CVE-2026-108112

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete ot

历史摘要 · 未重新核验 · NVD

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-a...

CVE-2026-108111

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that ex

历史摘要 · 未重新核验 · NVD

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx r...

CVE-2026-107813

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node a

历史摘要 · 未重新核验 · NVD

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses seriali...

CVE-2026-107811

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can acce

历史摘要 · 未重新核验 · NVD

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

CVE-2026-107813

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node a

历史摘要 · 未重新核验 · OSV.dev