90651 matches found
CVE-2026-80939
CVE-2026-80939 affects the Linux kernel rtw89 PCI WiFi driver on arm64 platforms. The root cause is a missing .shutdown callback: during warm reboot the kernel invokes device_shutdown() but not .remove(), so the rfkill polling workqueue continues issuing MMIO reads to the PCI device after the PCI...
CVE-2026-81915
Concrete CMS below 9.5.3 has a missing object-level authorization check in the Types::submit() dashboard controller. When updating a Page Type, the controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), allowing a signed-in dashboard user a...
EUVD-2026-76246
Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...
CVE-2026-49463 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...
EUVD-2026-76244
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...
CVE-2026-49463
NL Portal Backend Libraries (Dutch government portal backend) contained a missing per-user authorization in two GraphQL resolver areas. The nl.nl-portal:documenten-api package (all versions up to 3.0.0) and nl.nl-portal:besluiten package (1.5.0–3.0.0) both declared resolvers without an authentica...
CVE-2026-62089
Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...
intelligence
This repository does not have a README...
CVE-2024-11643
CVE-2024-11643 Accessibility by AllAccessible input type="hidden" name="optvalue" value...
CVE-2024-50510
CVE-2024-50510 AR For Woocommerce = 6.2 - 未经身份验证的任意文件上传 描述 WordPress 的 AR for WooCommerce 插件在所有版本（包括 6.2）中由于缺少文件类型验证，容易受到任意文件上传攻击。这使得未经身份验证的攻击者可以在受影响站点的服务器上上传任意文件，从而可能导致远程代码执行。 详细信息 类型 : plugin 标识符 : ar-for-woocommerce 受影响版本 : 6.2 CVSS 分数 : 9.8 CVSS 评级 : 严重 CVSS 向量 :...
CVE-2019-9053
此存储库没有 README。...
CVE-2021-45232
Apache APISIX Dashboard未授权访问漏洞CVE-2021-45232 FOFA 查询 title="Apache APISIX Dashboard" 影响范围 Apache APISIX Dashboard 2.10.1 POC: root@kitploit: IP:PORT/apisix/admin/migrate/export 修复建议 升级至最新安全版本 Apache APISIX Dashboard 2.10.1：https://github.com/apache/apisix-dashboard/releases/tag/v2.10.1...
CVE-2026-81909
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...
CVE-2026-81908
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...
EUVD-2026-76194
Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...
CVE-2026-62089 WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...
CVE-2026-62089
CVE-2026-62089 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Master Addons for Elementor by Pixar Labs, affecting versions from n/a through 3.2.2 . The flaw allows Privilege Abuse , enabling a low-privilege authenticated user to exploit the missing autho...
CVE-2026-68528
Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...
CVE-2026-18122
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...