Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user

CVE-2025-12523

Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user

来源摘录 · NVD / OSV.dev

@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

## Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot ### Summary `@eeacms/volto-chatbot` expo

来源摘录 · GitHub Advisory

Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administ...

CVE-2026-90863

Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and

来源摘录 · NVD

Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

CVE-2026-42690

Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

来源摘录 · NVD

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations ...

CVE-2026-119129

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that all

来源摘录 · NVD

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrar...

CVE-2026-110196

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypas

来源摘录 · NVD

Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issu...

CVE-2026-109891

Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorr

来源摘录 · NVD

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

CVE-2026-107327

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missi

来源摘录 · NVD

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4...

CVE-2026-97073

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Secu

来源摘录 · NVD

Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Secu...

CVE-2026-54871

Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder all

来源摘录 · NVD

Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prof...

CVE-2026-54853

Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configur

来源摘录 · NVD

Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Leve...

CVE-2026-54852

Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Explo

来源摘录 · NVD

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Use...

CVE-2026-52708

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured

来源摘录 · NVD

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Use...

CVE-2026-48884

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured

来源摘录 · NVD

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (f...

CVE-2026-27063

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured

来源摘录 · NVD

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ...

CVE-2026-25450

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Conf

来源摘录 · NVD

Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17...

CVE-2026-25448

Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Securit

来源摘录 · NVD

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security...

CVE-2026-118092

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows

来源摘录 · NVD

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: f...

CVE-2026-118091

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Acces

来源摘录 · NVD

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: f...

CVE-2026-118088

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Acces

来源摘录 · NVD