ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability:...
CVE-2026-105209
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey o
#cwe-862
共收录 4087 条相关情报。
← 返回所有主题ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organ...
CVE-2026-105209
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey o
ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
CVE-2026-105209
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey o
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is...
CVE-2026-11601
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authoriz
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is...
CVE-2026-94505
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization b
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is...
CVE-2026-94505
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization b
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19...
CVE-2026-11601
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authoriz
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a...
CVE-2026-92437
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for...
CVE-2026-91108
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and...
CVE-2026-97337
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content...
CVE-2026-101923
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, an
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via th...
CVE-2026-97337
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record ide...
CVE-2026-92437
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including...
CVE-2026-91108
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing at...
CVE-2026-101923
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, an
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &...
CVE-2026-93428
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in ...
CVE-2026-93428
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
CVE-2026-93428
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers
CVE-2026-74904
Same CWE-862 family, found via an automated bulk sweep of every `/api/block/*` handler in `kernel/api/block.go` for the
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
### Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persi