Veille CVE

Dimanche 11 octobre 2026

2 CVE sur 9

Critique 5 Élevée 1 Moyenne 1 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Create » ✕
  1. CVE-2026-104682 2.7 Faible

    Unknown Envira Gallery

    The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.

  2. CVE-2026-104681 2.7 Faible

    Unknown Envira Gallery

    The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.