按严重度 / 渠道 / 厂商 / 时间筛选公开漏洞条目。
CVE-2026-77003 · 2026-08-23 · auto
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site with…
CVE-2026-14187 · 2026-08-23 · auto
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other i…
CVE-2026-19699 · 2026-08-20 · auto
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata fro…
CVE-2020-15671 · 2026-08-19 · auto
When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary. …
CVE-2026-19965 · 2026-08-17 · auto
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password…
CVE-2026-14225 · 2026-08-07 · auto
The Easy Appointments WordPress plugin through 3.12.26 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rend…
CVE-2025-15674 · 2026-08-07 · auto
The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protecti…
CVE-2026-49005 · 2026-08-07 · auto
The root password hash of the device can be obtained through unencrypted information in the firmware.
CVE-2026-56577 · 2026-08-03 · auto
HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.
CVE-2025-4527 · 2026-07-31 · auto
A security flaw has been discovered in Dígitro NGC Explorer up to 3.48.21. The impacted element is an unknown function of the component Password Transmission Handler. Performing a manipulation results in client-side enfo…
CVE-2026-17720 · 2026-08-03 · auto
Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium securit…
CVE-2026-17715 · 2026-08-03 · auto
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chrom…
CVE-2026-32970 · 2026-07-25 · auto
OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in loca…
CVE-2025-69873 · 2026-08-24 · auto
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data re…
CVE-2026-26227 · 2026-07-14 · auto
VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Acces…