100 matches found
CVE-2026-111658 SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel...
CVE-2026-110227
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2...
EUVD-2026-100896
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2...
CVE-2026-110227 WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2...
CVE-2026-110227
The WordPress Restricted Site Access plugin (versions
CVE-2026-110227 WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2...
WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin Restricted Site Access versions = 7.6.2...
PT-2026-113703
Name of the Vulnerable Software and Affected Versions Restricted Site Access versions prior to 7.6.3 Description A missing authorization issue in the 10up Restricted Site Access plugin allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to ...
CVE-2026-110227: Missing Authorization
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2...
CVE-2026-79991
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...
EUVD-2026-70049
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...
CVE-2026-79990 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...
CVE-2026-79990 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...
CVE-2026-79990 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...
CVE-2026-84796
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
EUVD-2026-69908
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
PT-2026-84669
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
CVE-2026-79203
An improper input validation flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=532182486...
EUVD-2026-65351
The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor ca...