Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts
CVE-2026-103269
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site membe
#cwe-862
共收录 4087 条相关情报。
← 返回所有主题Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset
CVE-2026-103268
Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactiv
n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node
CVE-2026-103260
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's
n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
CVE-2026-103251
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulner
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
CVE-2026-103495
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
CVE-2026-103490
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containm...
CVE-2026-103659
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten op
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauth...
CVE-2026-96200
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to...
CVE-2026-90974
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs durin
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that...
CVE-2026-88999
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5
Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
CVE-2026-88999
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5
A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacke...
CVE-2026-76147
A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent u
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.
CVE-2026-76143
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by mani
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' paramet...
CVE-2026-92245
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or g...
CVE-2026-90441
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authe
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or g...
CVE-2026-86136
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authe
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard co...
CVE-2026-81841
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data
Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafte...
CVE-2026-102320
Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the
Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a cr...
CVE-2026-102310
Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised
Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineer...
CVE-2026-95371
Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compr