Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
CVE-2026-56829
## Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component ## Descript
#cwe-862
共收录 4122 条相关情报。
← 返回所有主题Shopper: privilege escalation via improper Livewire admin component authorization
CVE-2026-56828
## Summary Three Livewire admin components in `shopper/framework` (latest master at commit `fcd0c59`, released as v2.8.
Shopping privilege escalation through missing authorization in Settings components
CVE-2026-56826
## Summary Four Livewire components in the Settings area expose destructive Filament actions (`delete` / `edit`) that p
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referenc...
CVE-2026-68535
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's vali
Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable w...
CVE-2026-50025
Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mous
OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to writ...
CVE-2026-49439
OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoin
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
CVE-2026-56827
## Summary Five Filament `groupedBulkActions` blocks across the Shopper admin Livewire pages omit the `->authorize(...)
Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashbo...
CVE-2026-81916
Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the po
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Ty...
CVE-2026-81915
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::s
Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.
CVE-2026-62137
Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.
CVE-2026-62136
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 vers
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
CVE-2026-62135
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.
CVE-2026-62132
Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.
Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.
CVE-2026-62114
Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.
Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2.
CVE-2026-62089
Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affect
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.
CVE-2026-27378
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php).It does not ver...
CVE-2026-81909
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concre
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php...
CVE-2026-81908
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The list
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection end...
CVE-2026-18122
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization;
SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform pr...
CVE-2026-72709
SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/ac