MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability...
CVE-2026-108695
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accoun
#cwe-863
共收录 2098 条相关情报。
← 返回所有主题MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings R...
CVE-2026-108695
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accoun
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass...
CVE-2026-108604
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked wo...
CVE-2026-108595
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_o
Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir
CVE-2026-108595
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_o
1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using ne...
CVE-2026-108586
1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticat
1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter
CVE-2026-108586
1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticat
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other...
CVE-2026-108550
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeControll
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is f...
CVE-2026-108114
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all
SkillHub before 0.2.22 Account Takeover via Account Merge Flow
CVE-2026-108550
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeControll
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor r...
CVE-2026-105976
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJA
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including...
CVE-2026-6723
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Inc
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /...
CVE-2026-108263
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow co
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches ...
CVE-2026-107851
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
## Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion aut
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
## Summary A collaborator removed from a project keeps a **live, automatic feed** of that project's contents, because n
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
### Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open
Contao: Improper access control in the table access voter
CVE-2026-107851
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend,
Vikunja: Link-share token can enumerate users through the v2 API
CVE-2026-91981
### Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-s
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
CVE-2026-91983
## Summary API token permission checks only match the HTTP method and route path. The `expand` query parameter on task