Каталоги
В сервис интегрированы наиболее популярные публичных базы знаний:
- Сертификаты СЗИ - Государственный реестр сертифицированных средств защиты информации опубликованный Федеральной службой по техническому и экспортному контролю, может быть использован для контроля актуальности используемых СЗИ в организации.
- CWE уязвимости - общедоступная публичная база распространенных типов уязвимостей в программном и аппаратном обеспечении, которые могут иметь последствия для безопасности - Common weakness enumeration.
- CVE уязвимости - общедоступная публичная база уязвимостей Common Vulnerabilities and Exposures (CVE). Миссия программы CVE заключается в выявлении, определении и каталогизации публично раскрываемых уязвимостей в сфере кибербезопасности. Для каждой уязвимости в каталоге существует одна запись CVE. Уязвимости обнаруживаются, затем присваиваются и публикуются организациями по всему миру, которые сотрудничают с программой CVE. Партнеры публикуют записи CVE для единообразного описания уязвимостей. Специалисты в области информационных технологий и кибербезопасности используют записи CVE, чтобы убедиться, что они обсуждают одну и ту же проблему, и координировать свои усилия по определению приоритетности и устранению уязвимостей.
- БДУ ФСТЭК уязвимости - раздел Уязвимости Банка данных уязвимостей опубликованная Федеральной службой по техническому и экспортному контролю совместно с Государственным научно-исследовательским испытательным институтом проблем технической защиты информации. Одной из целей создания банка данных угроз безопасности информации является объединение специалистов в области информационной безопасности для решения задач повышения защищенности информационных систем.
- НКЦКИ уязвимости - общедоступная публичная база уязвимостей Национального координационного центра по компьютерным инцидентам (НКЦКИ), обеспечивающего координацию деятельности субъектов КИИ по обнаружению, предупреждению, ликвидации последствий компьютерных атак и реагированию на компьютерные инциденты.
- MITRE ATT&CK – Adversarial Tactics, Techniques & Common Knowledge – Тактики, техники и общеизвестные знания о злоумышленниках. Это основанная на реальных наблюдениях база знаний компании Mitre, содержащая описание тактик, приемов и методов, используемых киберпреступниками. База создана в 2013 году и регулярно обновляется, цель – составление структурированной матрицы используемых киберпреступниками приемов, чтобы упростить задачу реагирования на киберинциденты.
- БДУ ФСТЭК и Новая БДУ ФСТЭК – раздел Угрозы Банка данных угроз, опубликованный в 2015 году Федеральной службой по техническому и экспортному контролю и Государственным научно-исследовательским испытательным институтом проблем технической защиты информации, обязателен при моделировании угроз при построении систем защиты персональных данных, критической информационной инфраструктуры, государственных информационных систем.
- Exploits & Shellcodes - база данных эксплойтов поддерживается OffSec, обучающей компанией по информационной безопасности, которая предоставляет различные сертификаты по информационной безопасности, а также услуги по тестированию на проникновение высокого класса.
Каталог Справка открывает раздел документации по каталогам.
Мониторинг
Мониторинг следит за пополнением каталога «Сертифицированные СЗИ» и сам реагирует на записи, которые подходят под условия Фильтра. Система проверяет каталог самостоятельно и создаёт активы, задачи или присылает уведомление. Функционал избавляет от необходимости открывать и просматривать реестр вручную.
Фильтры:
Фильтры:
- Наименование СЗИ. При указании нескольких значений через разделитель "||", в фильтр попадёт запись, совпавшая с любым из указанных значений.
- Заявитель. Организация, подавшая средство на сертификацию. При указании нескольких значений через разделитель "||", в фильтр попадёт запись, совпавшая с любым из указанных значений.
- Номер сертификата. При указании нескольких значений через разделитель "||", в фильтр попадёт запись, совпавшая с любым из указанных значений.
Примечание: между фильтрами используется логическое "И".
Действия:
- Создать актив
- Тип Актива
- Ответственный
Создаёт актив ТА Средство защиты информации. У актива будут заполнены поля Владелец (заполняется из поля Ответственный) и Номер сертификата СЗИ.
- Создать задачу
- Ответственный
Создаёт задачу на указанного ответственного.
- Ответственный
- Отправить уведомление
- Ответственный
Отправляет уведомление внутри системы указанному ответственному.
- Ответственный
Уязвимости CVE, БДУ ФСТЭК и НКЦКИ
Каталоги CVE уязвимости, БДУ ФСТЭК уязвимости и НКЦКИ уязвимости предоставляют дополнительный контент и обогащают информацией описание уязвимостей от сканеров в модуле Технические уязвимости.
Интерфейс каталогов идентичен и содержит следующие блоки:
- Метрики:
- Найденные уязвимости – отображает количество найденных в отчетах от сканеров уязвимостей которые связаны с уязвимостями из каталога, при нажатии на виджет перенаправляет в модуль Технические уязвимости с установленным фильтром по названию каталога (тип фильтра Группа уязвимостей);
- Уязвимые хосты – отображает количество хостов на которых обнаружены уязвимости связанные с уязвимостями из каталога, при нажатии на виджет перенаправляет в модуль Технические уязвимости с установленным фильтром по названию каталога (тип фильтра Группа уязвимостей).
- Табличную часть Каталог уязвимостей:
- Фильтр по полю Идентификатор - особенностью данного фильтра является автоматический разбор текста с последующим извлечением из текста идентификаторов. Для этого необходимо вставить произвольный текст с идентификаторами в поле и добавить в фильтр через кнопку плюс;
- Табличную часть с полями для каталогов CVE и БДУ ФСТЭК:
- Идентификатор - id уязвимости в базе уязвимостей;
- Описание - текстовое описание уязвимости;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- CVSS - числовая оценка уязвимости согласно источнику, с указанием даты выявления уязвимости экспертами, оценка отображается цветом согласно оценке CVSS 0.1 – 3.9 Low Зеленый,
4.0 – 6.9 Medium Желтый, 7.0 – 8.9 High Оранжевый, 9.0 – 10.0 Critical Красный.
- Табличную часть с полями для каталогов CVE :
- Дата бюллетеня - информация о дате публикации бюллетеня содержащего уязвимости;
- Идентификатор - id уязвимости в базе уязвимостей;
- Информация - текстовое описание уязвимости;
- Вектор атаки - локальный или сетевой вектор атаки;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Наличие обновления - - флаг, данный статус отображается если база уязвимостей содержит информацию о наличии обновлений от производителя уязвимого ПО;
- Дата выявления - даты выявления уязвимости экспертами.
- Чекбокс «Только обнаруженные уязвимости» - устанавливает фильтр на табличную часть для отображения только обнаруженные уязвимости.
- Функционал для экспорта всех уязвимостей каталога.
- Для каталога добавляется функционал Варианты отображения:
- Бюллетени - изменяет отображение табличной части на реестр бюллетеней, отображает общее количество уязвимостей в бюллетени в поле Уязвимостей в бюллетени и статус по обнаружению в поле Обнаружено - данный статус отображается если хотя бы одна уязвимость из бюллетеня обнаружена в инфраструктуре.
- Уязвимости.
MITRE ATT&CK, БДУ ФСТЭК, Новая БДУ ФСТЭК
Данные из каталогов MITRE ATT&CK, БДУ ФСТЭК, Новая БДУ ФСТЭК могут использоваться для контекстного наполнения риска в модуле Риски.
Каждый из указанных каталогов сформирован по собственной схеме данных, которая не соответствует подходу оценки риска, используемому в сервисе. Но в основе своей указанные базы описывают все те же риски информационной безопасности, каждый под своим углом. Поэтому они добавлены в сервис и как отдельные компоненты и как основа для создания рисков, угроз или уязвимостей.
Каталоги могут использоваться в сервисе с целью:
- Облегчения процесса формирования рисков, угроз и уязвимостей;
- Обогащения информации по рискам (угрозам, уязвимостям) созданным в сервисе.
- Взгляда на компанию и оценку рисков через публичные каталоги угроз.
Сервис позволяет установить связь между объектами из каталогов и 3 типами объектов сервиса: угрозами, уязвимостями или рисками безопасности:
- Уязвимости могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK и способами реализации Новой БДУ ФСТЭК.
- Угрозы могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK, угрозами и последствиями Новой БДУ ФСТЭК.
- Риски могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK, угрозами, способами реализации и последствиями Новой БДУ ФСТЭК.
Такой широкий выбор возможных связей сделан потому, что объекты из каталогов угроз могут быть или угрозой или уязвимостью в контексте сервиса.
Например, УБИ.004 Угроза аппаратного сброса пароля BIOS из БДУ ФСТЭК в контексте сервиса является уязвимостью, особенностью активов типа Микропрограммное обеспечение, которая может привести к реализации угрозы Несанкционированного локального доступа к BIOS.
В большинстве случаев угрозы из БДУ ФСТЭК и техники из MITRE ATT@CK являются именно уязвимостями, использование которых ведет к реализации угроз безопасности, но бывают и исключения.
Для рисков, угроз и уязвимостей из базы Community связи с каталогами угроз уже установлены.
Связь с каталогом угроз может быть прямой или косвенной. Например, если уязвимость связана с угрозой из БДУ ФСТЭК то и все риски, в составе которых есть данная уязвимость будут автоматически связаны с угрозой из БДУ ФСТЭК.
Каталог БДУ ФСТЭК - это реестр рисков от банка данных угроз безопасности информации ФСТЭК России.
Каждая угроза содержит описание, рекомендации к каким типам активов может быть применена эта угроза, классификация по свойствам информации и вероятные источники угрозы. Дополнительно в блоке Связанные риски указаны связанные риски, а в блоке Каталоги указываются связи с записями из других каталогов.
Каталог Новая БДУ ФСТЭК от банка данных угроз безопасности информации ФСТЭК России содержит:
- матрицу Способы реализации (возникновения угроз) - каждая ячейка которых содержит описание поверхности атаки: группу способов, уровень возможностей нарушителя, возможные реализуемые угрозы, компоненты объектов воздействия, возможные меры защиты;
- Негативные последствия - перечень негативных последствий в классификации ФСТЭК в виде кода и описания;
- Угрозы - реестр угроз с описанием, каждая угроза содержит возможные объекты воздействия и возможные способы реализации угроз;
- Объекты - перечень объектов последствий с описанием и компонентами которые могут входить в состав объекта;
- Компоненты - перечень компонентов объектов воздействия с указанием объектов воздействия на которых они могут располагаться;
- Нарушители - уровни возможностей нарушителей классифицированные по возможностям и компетенции;
- Меры защиты - в терминологии SECURITM это список требований выполнение которых сокращает возможности нарушителя.
Каталог MITRE ATT&CK содержит:
- Матрица - содержит тактики и техники злоумышленника, позволяет на основании тактики или техники создать риск или уязвимость, в матрице указаны связи с рисками в базе Community и с рисками в базе команды;
- Тактики - направления действия нарушителя на том или ином этапе cyberkillchane;
- Техники - конкретные действия нарушителя для достижения цели на конкретном шаге cyberkillchane;
- Контрмеры - в терминологии SECURITM это список требований выполнение которых сокращает возможности нарушителя;
- Преступные группы - описание APT группировок и их особенности и модель поведения;
- Инструменты - ПО используемое нарушителями для вредоносного воздействия.
Матрицы могут использоваться для построения тепловой карты рисков наложенных на матрицы угроз и уязвимостей.
Уязвимости CWE
Каталог CWE уязвимости предоставляет дополнительный контент и обогащают информацией описание уязвимостей от сканеров в модуле Технические уязвимости.
Интерфейс каталогов идентичен и содержит следующие блоки:
- Табличную часть Каталог уязвимостей:
- Фильтр по полю Идентификатор;
- Табличную часть с полями:
- Идентификатор - id уязвимости в базе уязвимостей;
- Имя - текстовое описание уязвимости;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Чекбокс «Только обнаруженные уязвимости» - устанавливает фильтр на табличную часть для отображения только обнаруженные уязвимости.
Каталог Exploits & Shellcodes
Каталог используется для обогащения информацией карточек уязвимостей. Каталог хранит описания готовых скриптов и кода, для эксплуатации уязвимостей, из публичного источника Exploit-DB. В карточке эксплойта отображаются все атрибуты, блоки связанные с каталогами уязвимостей CVE, БДУ, НКЦКИ, CWE.
Интерфейс каталогов идентичен и содержит следующие блоки:
Табличную часть Каталог уязвимостей:
Интерфейс каталогов идентичен и содержит следующие блоки:
Табличную часть Каталог уязвимостей:
- Фильтр по типу (exploit или shellcode);
- Фильтр по полю Платформа;
- Чекбокс «Только проверенные» - устанавливает фильтр на табличную часть для отображения только проверенных уязвимостей.
Табличную часть с полями:
- Идентификатор - id уязвимости в базе уязвимостей;
- Тип - к какому типу относится уязвимость Exploit / Shellcode;
- Описание - текстовое описание уязвимости;
- Платформа - на каких платформах проявляется;
- Дата публикации - информация о дате публикации;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Проверено - флаг, данный статус отображается если уязвимость является проверенной.
Каталог CISA KEV
Каталог CISA KEV содержит уязвимости, использование которых подтверждено в реальных атаках. Он помогает определить, какие из них затрагивают Ваши активы и требуют первоочередного устранения.
Поиск и фильтры
Интерфейс каталога содержит следующие блоки:
- Табличную часть Каталог уязвимостей
- дата добавления в каталог;
- идентификатор CVE;
- название уязвимости;
- количество обнаруженных у вас уязвимостей, соответствующих записи;
- признак Ransomware;
- срок устранения.
- Чтобы ограничить список, используйте фильтры:
- Только ransomware показывает уязвимости, об использовании которых в атаках программ-вымогателей известно по данным CISA.
- Только обнаруженные уязвимости оставляет записи, которым соответствуют уязвимости ваших активов.
- Доступен поиск по идентификатору CVE.
Карточка записи
Чтобы открыть карточку, нажмите на идентификатор CVE.
Карточка содержит:
Карточка содержит:
- Название уязвимости
- Производитель и продукт, к которому относится уязвимость
- Дата добавления в каталог
- Срок устранения: дата, к которой CISA рекомендует закрыть уязвимость (указана не у всех записей)
- Использование в ransomware-кампаниях: сведения CISA об использовании уязвимости в атаках программ-вымогателей
- Требуемое действие: рекомендации CISA по устранению уязвимости
- Связанные записи каталогов CVE, CWE, БДУ ФСТЭК и НКЦКИ
- Ссылки на источники: бюллетени производителя и материалы CISA
- Обнаруженные уязвимости: уязвимости ваших активов, соответствующие записи каталога
Отметки на уязвимостях
- В реестре технических уязвимостей записи, входящие в каталог, отмечены красной меткой CISA KEV. Она указывает на подтвержденное использование уязвимости в реальных атаках.
- В карточке технической уязвимости появляется блок CISA KEV со связанной записью каталога. Связь определяется по коду CVE.
Обновление каталога
- Администратор системы загружает каталог в формате JSON через Глобальные настройки. Перед загрузкой необходимо обновить каталог CVE: запись CISA KEV отображается только при наличии соответствующего кода в каталоге CVE.
- Списки и счетчики каталога обновляются сразу после загрузки. Красные отметки на технических уязвимостях обновляются по расписанию, поэтому могут появиться позже.
Сертификаты СЗИ
Каталог Сертификаты СЗИ (ФСБ) может быть использован в модуле Активы как источник информации для поля Номер сертификата ФСБ. В модуле активов есть возможность вести реестр СЗИ используемых в организации, в свою очередь каталог сертификатов СЗИ позволяет связать актив с каталогом через поле актива Номер сертификата ФСБ.
Каталог Сертификаты СЗИ содержит реестр с информацией регистрационном номере сертификата соответствия, начале и окончания действия сертификата и о выполняемой функции. Кроме реестра каталог содержит следующие метрики:
Каталог Сертификаты СЗИ содержит реестр с информацией регистрационном номере сертификата соответствия, начале и окончания действия сертификата и о выполняемой функции. Кроме реестра каталог содержит следующие метрики:
- Имеющиеся СЗИ
- Скоро будут просрочены
- Просроченные сертификаты
Каждая метрика ведёт в реестр активов и выводит список СЗИ, отфильтрованный по соответствующим параметрам.
Нажав на просмотр сертификата, мы увидим карточку сертификата, сервис хранит информацию о следующих данных:
- Регистрационный номер сертификата соответствия;
- Начало действия сертификата соответствия;
- Окончание действия сертификата соответствия;
- Условное наименование (индекс);
- Выполняемая функция.
Реестр наполняется и обновляется исключительно вручную. В каталоге сертификатов СЗИ (ФСБ) имеется кнопка Импорт, она доступна только Глобальному Администратору.
Чтобы импортировать каталог, необходимо:
- Скачать выписку из перечня средств защиты информации, сертифицированных ФСБ России, на сайте clsz.fsb.ru.
- Открыть её средством редактирования текстовых документов, сохранить в формате .docx (файл с сайта ФСБ имеет старый формат и не читается корректно).
- Открыть Каталоги → Сертификаты СЗИ (ФСБ) , нажать кнопку «Импорт».
- Выбрать файл, нажать кнопку импорт.
Куда я попал?
CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
| Тип уязвимости: | Не зависит от других уязвимостей |
| Вероятность эксплойта: |
High
|
Идентификаторы ФСТЭК уязвимостей
Идентификатор, базы данных общеизвестных уязвимостей информационной безопасности
| Идентификатор | Описание |
|---|---|
| BDU:2015-11945 | Уязвимость веб-приложения для синхронизации данных ownCloud, позволяющая нарушителю читать данные произвольных календарей |
| BDU:2019-01142 | Уязвимость пакета для настройки виртуальной машины cloud-init операционных систем семейства Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2020-00117 | Уязвимость программного средства McAfee Client Proxy, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обходить сканирование веб-трафика и получать доступ к заблокированным сайтам |
| BDU:2020-01954 | Уязвимость функции local_graph_id системы мониторинга сервера Cacti, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить доступ к конфиденциальным данным |
| BDU:2020-05534 | Уязвимость компонента xAPI микропрограммного обеспечения устройства управления конференц-связью Cisco TelePresence Collaboration Endpoint (CE) и операционной системы Cisco RoomOS, позволяющая нарушителю выполнить произвольный код |
| BDU:2021-03179 | Уязвимость универсальной системы мониторинга Zabbix, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обойти страницу входа и получить доступ к странице панели инструментов |
| BDU:2021-04525 | Уязвимость системы аутентификации для веб-приложений LemonLDAP::NG, связанная с ошибкой обработки ключей авторизации, позволяющая нарушителю проводить спуфинг-атаки |
| BDU:2022-01309 | Уязвимость службы Key Storage Provider (KSP) операционной системы Microsoft Windows, позволяющая нарушителю обойти процесс аутентификации |
| BDU:2022-04072 | Уязвимость программного средства создания веб-служб go-restful, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая наруштителю повысить свои привилегии |
| BDU:2023-02460 | Уязвимость микропрограммного обеспечения контроллеров Nexx Garage Door Controller (NXG-100B, NXG-200), Nexx Smart Plug (NXPG-100W), Nexx Smart Alarm (NXAL-100), связанная с обходом авторизации посредством использования ключа, контролируемого пользова... |
| BDU:2023-02461 | Уязвимость микропрограммного обеспечения контроллеров Nexx Garage Door Controller (NXG-100B, NXG-200), Nexx Smart Plug (NXPG-100W), Nexx Smart Alarm (NXAL-100), связанная с обходом авторизации посредством использования ключа, контролируемого пользова... |
| BDU:2023-02620 | Уязвимость платформы автоматизации NGINX Instance Manager, диспетчера подключений API NGINX API Connectivity Manager и платформы мониторинга и управления безопасностью NGINX Security Monitoring, связанная с обходом авторизации посредством использован... |
| BDU:2023-05478 | Уязвимость инструмента проверки кода Crucible, инструмента поиска и сравнения кода Fisheye , связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой инфор... |
| BDU:2023-06062 | Уязвимость компонента graph_xport.php программного средства мониторинга сети Cacti, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06462 | Уязвимость программного обеспечения защиты данных Acronis Cyber Protect 15, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06463 | Уязвимость программного обеспечения защиты данных Acronis Cyber Protect 15, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06699 | Уязвимость программного средства для централизованного управления устройствами Fortinet FortiManager, межсетевого экрана FortiAnalyzer, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить до... |
| BDU:2023-06795 | Уязвимость программных платформ для разработки и управления онлайн магазинами Magento Open Source и Adobe Commerce, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06799 | Уязвимость функции аутентификации SASL Quorum Peer централизованной службы для поддержки информации о конфигурации, именования, обеспечения распределенной синхронизации и предоставления групповых служб Apache ZooKeeper, позволяющая нарушителю обойти... |
| BDU:2023-07494 | Уязвимость программного обеспечения мониторинга банкоматов ScrutisWeb, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-07999 | Уязвимость плагинов EventOn Lite и EventON системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-08301 | Уязвимость программного обеспечения автоматизации службы поддержки и контроля аппаратного и программного обеспечения SysAid, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получи... |
| BDU:2023-09003 | Уязвимость микропрограммного обеспечения телетрансляторов EuroTel ETL3100 и EuroTel ETL3100RT, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обойти ограничения безопасности, пол... |
| BDU:2024-00276 | Уязвимость процесса промежуточной установки микропрограммного обеспечения коммуникационного шлюза SIMATIC CN 4100, позволяющая нарушителю войти в систему и получить полный контроль над приложением |
| BDU:2024-01987 | Уязвимость компонента SSL-VPN операционных систем FortiOS и прокси-сервера для защиты от интернет-атак FortiProxy, позволяющая нарушителю получить несанкционированный доступ к веб-странице другого пользователя |
| BDU:2024-02400 | Уязвимость операционной системы FortiOS, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации |
| BDU:2024-02546 | Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с обходом авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-03194 | Уязвимость службы secondscreen.gateway операционной системы LG WebOS для телевизоров LG, позволяющая нарушителю создать привилегированную учетную запись пользователя |
| BDU:2024-03857 | Уязвимость программного средства корпоративной телефонии FortiVoice связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю раскрыть конфигурационные SIP-файлы |
| BDU:2024-04116 | Уязвимость веб-инструмента представления данных Grafana, связанная с обходом авторизации, позволяющая нарушителю обойти процесс авторизации и удалить моментальный снимок |
| BDU:2024-04604 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2024-05341 | Уязвимость программной платформы интеграции данных IBM InfoSphere Information Server, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю раскрыть защищаемую информацию или изменить произвольные данн... |
| BDU:2024-06159 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с ошибкой обработки токенов LFS, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и записывать произвольные файлы |
| BDU:2024-06229 | Уязвимость интерфейса администрирования инструмента аналитики и управления безопасностью Fortinet FortiPortal, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2024-07659 | Уязвимость компонента Group Member Handler программной платформы на базе git для совместной работы над кодом GitLab, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-07780 | Уязвимость программной платформы создания веб-приложений Next.js, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2024-08483 | Уязвимость операционной системы Junos OS Evolved, связанная с обходом авторизации посредством использования ключа, позволяющая нарушителю обойти существующие ограничения безопасности, войти в систему и получить полный контроль над устройством |
| BDU:2024-08756 | Уязвимость программного обеспечения защиты данных Acronis Cyber Protect 16, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-08968 | Уязвимость микропрограммного обеспечения роутеров TOTOLINK LR350, связанная с недостатками процедуры авторизации, позволяющая нарушителю обойти ограничения безопасности |
| BDU:2024-09384 | Уязвимость платформы централизованного управления промышленными периферийными приложениями и устройствами Siemens Industrial Edge Management (IEM), связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позвол... |
| BDU:2024-10391 | Уязвимость интерфейса администрирования инструмента аналитики и управления безопасностью Fortinet FortiPortal, позволяющая нарушителю взаимодействовать с ресурсами других организаций |
| BDU:2024-10862 | Уязвимость компонента cgi-bin/ocap/ библиотечной системы AbsysNet, позволяющая нарушителю реализовать атаку методом "грубой силы" (brute force) |
| BDU:2024-11319 | Уязвимость пакета клиентской и серверной реализации протокола SSHv2 asyncssh интерпретатора языка программирования Python, позволяющая нарушителю проводить атаки типа "человек по середине" |
| BDU:2024-11391 | Уязвимость платформы для мониторинга, управления и улучшения приложений LLM Lunary, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на целостность и конфиденциальн... |
| BDU:2024-11393 | Уязвимость функции "Evaluations" платформы для мониторинга, управления и улучшения приложений LLM Lunary, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2024-11482 | Уязвимость службы Streaming Service медиасервера Synology Media Server, позволяющая нарушителю читать произвольные файлы |
| BDU:2024-11512 | Уязвимость программного средства для централизованного управления устройствами Fortinet FortiManager, межсетевого экрана FortiAnalyzer, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая наруши... |
| BDU:2025-00548 | Уязвимость микропрограммного обеспечения многоконтурного измерителя электрического напряжения PowerLogic HDPM6000, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю повысить свои пр... |
| BDU:2025-00581 | Уязвимость инструментов для автоматизации бизнес-процессов в системе SAP SAP Business Workflow и SAP Flexible Workflow, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить не... |
| BDU:2025-01981 | Уязвимость веб-инструмента представления данных Grafana, связанная с обходом авторизации с помощью ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2025-02019 | Уязвимость плагина Meetup системы управления содержимым сайта WordPress, связанная сбходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-02550 | Уязвимость панели приложений в реальном времени управления содержимым базы данных SQL Directus, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить доступ к учётной записи по... |
| BDU:2025-02561 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab Enterprise Edition, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-02938 | Уязвимость платформы автоматизации процессов электронного документооборота Documino, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаем... |
| BDU:2025-03630 | Уязвимость компонента Manage Bank Statements программной платформы SAP S/4HANA, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2025-03631 | Уязвимость платформы проектирования бизнес-приложений SAP Fiori, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2025-03853 | Уязвимость компонента Sherpa Orchestrator платформы для автоматизации процессов Sherpa RPA, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-04613 | Уязвимость системы автоматизации рекрутинговых процессов E-Staff, связанная с ошибками фильтрации данных при получении информации об объекте, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05103 | Уязвимость виртуальной обучающей среды Moodle, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05106 | Уязвимость компонента RSS Block виртуальной обучающей среды Moodle, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05111 | Уязвимость компонента Multi-Factor Authentication виртуальной обучающей среды Moodle, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2025-05996 | Уязвимость расширения femanager системы управления контентом TYPO3, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-06007 | Уязвимость расширения Front End User Registration (sr_feuser_register) системы управления контентом TYPO3, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-06008 | Уязвимость расширения Download manager (reint_downloadmanager) системы управления контентом TYPO3, позволяющая нарушителю загружать произвольные файлы |
| BDU:2025-06734 | Уязвимость API-интерфейса программного средства для создания отчетов Cisco Unified Intelligence Center и программного средства для управления контакт-центрами Unified Contact Center Enterprise (Cisco Unified CCX), позволяющая нарушителю повысить свои... |
| BDU:2025-06822 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09771 | Уязвимость команды set-initial-sql аналитической платформы Tableau Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09793 | Уязвимость команды validate-initial-sql аналитической платформы Tableau Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09794 | Уязвимость интерфейса Tab-Doc API аналитической платформы Tableau Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-10193 | Уязвимость cистемы управления предприятием EvaProject (Carbon ERP), связанная с использованием небезопасной прямой ссылкой на объект (IDOR), позволяющая нарушителю получить доступ к защищаемой информации |
| BDU:2025-10638 | Уязвимость веб-панели управления многофункционального устройства (МФУ) Катюша М348, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-10982 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab EE/CE, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к данным пользоват... |
| BDU:2025-11316 | Уязвимость сценария ExportSettings.sh (/cgi-bin/ExportSettings.sh) микропрограммного обеспечения роутеров TOTOLINK EX200, позволяющая нарушителю обойти ограничения безопасности и получить несанкционированный доступ к защищаемой информации |
| BDU:2025-12643 | Уязвимость системы управления "Ассистент", связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-12658 | Уязвимость интерфейса администрирования инструмента аналитики и управления безопасностью Fortinet FortiPortal, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-13145 | Уязвимость системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI, связанная с обходом авторизации посредством ключа, позволяющая нарушителю получить несанкционированный доступ на изменение защищаемой информации |
| BDU:2025-13638 | Уязвимость функции service_finder_switch_back() плагина Service Finder Bookings системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-15285 | Уязвимость компонента GetPasswordExpirationDate интерфейса прикладного программирования Exchange Web Services, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-15734 | Уязвимость системы взаимодействия с клиентами IntraService, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2025-15862 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-16374 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-16491 | Уязвимость программного обеспечения для управления процессами подачи заявок Bidding Solutions, связанная с ошибкой обработки токенов LFS, позволяющая нарушителю получить несанкционированный доступ к учетным записям пользователям |
| BDU:2026-00759 | Уязвимость промышленных систем удаленного доступа mymbCONNECT24 и mbCONNECT24, VPN-портала myREX24 и виртуального сервера myREX24.virtual, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нар... |
| BDU:2026-00971 | Уязвимость механизма резервирования конфигурационных данных платформы виртуализации zVirt, позволяющая нарушителю получить несанкционированный доступ к конфигурационным данным |
| BDU:2026-00987 | Уязвимость программной платформы комплексного сетевого управления D-Link D-View, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить полный контроль над учетной записью и системой |
| BDU:2026-01728 | Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность и доступность защи... |
| BDU:2026-01729 | Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность и доступность защи... |
| BDU:2026-01730 | Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность и доступность защи... |
| BDU:2026-01731 | Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность и доступность защи... |
| BDU:2026-01732 | Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность и доступность защи... |
| BDU:2026-01945 | Уязвимость конечной точки /api-selfportal/get-info-token-properties программного комплекса Secure Authentication Server, позволяющая нарушителю провести атаку методом перебора и получить несанкционированный доступ к токенам пользователей |
| BDU:2026-03382 | Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказа... |
| BDU:2026-03580 | Уязвимость приложения Nextcloud calendar облачного программного обеспечения для создания и использования хранилища данных Nextcloud, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-04702 | Уязвимость пользовательского интерфейса Nginx UI сервера nginx, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой и... |
| BDU:2026-05092 | Уязвимость системы для ведения медицинской документации OpenEMR, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2026-05149 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации с помощью управляемого пользователем ключа, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-05296 | Уязвимость платформы для обмена файлами Flare, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на конфиденциальность защищаемой информации |
| BDU:2026-05297 | Уязвимость платформы для обмена файлами Flare, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-05791 | Уязвимость программного обеспечения для телекоммуникационного оборудования QAFA Firmware, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить доступ к административной web-консоли |
| BDU:2026-06413 | Уязвимость модуля отображения Blink браузера Google Chrome, позволяющая нарушителю выполнить подмену пользовательского интерфейса |
| BDU:2026-06982 | Уязвимость платформы для автоматизации рабочих процессов N8n, связанная с обходом авторизации с помощью управляемого пользователем ключа, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-07008 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаем... |
| BDU:2026-07013 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность защищаемой... |
| BDU:2026-07015 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность защищаемой... |
| BDU:2026-07016 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаем... |
| BDU:2026-07021 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность защищаемой... |
| BDU:2026-07132 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных |
| BDU:2026-07138 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователемI, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07139 | Уязвимость функции has_access_to_file() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных |
| BDU:2026-07141 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07142 | Уязвимость функции _validate_collection_access() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07451 | Уязвимость службы управления доступом Azure Privileged Identity Management (PIM) пакета для обеспечения совместимости Microsoft Azure Entra ID, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-07456 | Уязвимость функции update_message_by_id() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных |
| BDU:2026-07457 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07488 | Уязвимость механизма авторизации исполнителей рабочих процессов искусственного интеллекта Duo AI workflow runners программной платформы на базе git для совместной работы над кодом GitLab, позволяющая нарушителю оказать воздействие на конфиденциальнос... |
| BDU:2026-07548 | Уязвимость интерфейса Boards API (Focalboard) приложения для обмена мгновенными сообщениями Mattermost, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07583 | Уязвимость плагина moodle-mod_customcert виртуальной обучающей среды Moodle, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07772 | Уязвимость геоаналитической платформы с машинным обучением BestPlace, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и захватить уче... |
| BDU:2026-07784 | Уязвимость конечной точки /core/preview облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-09075 | Уязвимость программного интерфейса программной платформы на базе git для совместной работы над кодом GitLab EE, позволяющая нарушителю получить несанкционированный доступ на чтение и изменение защищаемой информации |
| BDU:2026-09689 | Уязвимость платформы "Доктор рядом. Телемед Премиум", связанная с обходом авторизации с помощью управляемого пользователем ключа, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-09690 | Уязвимость платформы "Доктор рядом. Телемед Премиум", связанная с обходом авторизации с помощью управляемого пользователем ключа, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-10240 | Уязвимость функции getParameter() класса AbstractSalesforceProcessor компонента camel-salesforce фреймворка Apache Camel, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-10659 | Уязвимость компонента Apache Camel JIRA java-фреймворка Apache Camel, позволяющая нарушителю получить несанкционированный доступ на чтение, изменение, добавление и удаление объектов |
| BDU:2026-10993 | Уязвимость функции get_flow_by_id_or_endpoint_name инструмента для создания и развёртывания агентов и рабочих процессов Langflow, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2026-11135 | Уязвимость файла dist/routes/oauth2/index.js программной платформы для создания пользовательских интерфейсов поверх языковых моделей (LLM) Flowise, позволяющая нарушителю осуществить SSRF-атаку и раскрыть защищаемую информацию |
| BDU:2026-13038 | Уязвимость компонента Paint веб-браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю оказать воздействие на целостность данных |
| BDU:2026-13150 | Уязвимость обработчика TUS распределенной файловой системы SeaweedFS, позволяющая нарушителю обойти существующие механизмы безопасности и получить доступ на запись и удаление произвольных файлов |
| BDU:2026-14358 | Уязвимость программного обеспечения для безопасного обмена и передачи файлов SolarWinds Serv-U, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю выполнить произвольный код |
| BDU:2026-14364 | Уязвимость программного обеспечения для безопасного обмена и передачи файлов SolarWinds Serv-U, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю выполнить произвольный код |
| BDU:2026-14367 | Уязвимость программного обеспечения для безопасного обмена и передачи файлов SolarWinds Serv-U, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии и выполнит... |
| BDU:2026-14371 | Уязвимость программного обеспечения для безопасного обмена и передачи файлов SolarWinds Serv-U, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии и получить несанкциониро... |
| BDU:2026-14376 | Уязвимость программного обеспечения для безопасного обмена и передачи файлов SolarWinds Serv-U, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю осуществить перехват сессии и захватить учетную з... |
| BDU:2026-14378 | Уязвимость программного обеспечения для безопасного обмена и передачи файлов SolarWinds Serv-U, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю захватить учетную запись |
| BDU:2026-14381 | Уязвимость программного обеспечения для безопасного обмена и передачи файлов SolarWinds Serv-U, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии до уровня системного адм... |
| BDU:2026-14440 | Уязвимость службы управления доступом и идентификацией Microsoft Azure Active Directory B2C, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-14553 | Уязвимость системы управления базами данных (СУБД) Azure Cosmos DB, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю проводить спуфинг-атаки |
| BDU:2026-15361 | Уязвимость механизма управления файлами и вложениями сервиса визуализации данных Kibana, позволяющая нарушителю обойти ограничения безопасности |
| BDU:2026-15389 | Уязвимость механизма работы с идентификаторами объектов сервиса визуализации данных Kibana, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-15769 | Уязвимость функции ServeAttachment(ctx *context.Context, uuid string) файла routers/web/repo/attachment.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-15783 | Уязвимость функции UpdateIssueAttachments() файла models/issues/issue_update.go и функции UpdateCommentAttachments() файла models/issues/comment.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциал... |
| BDU:2026-15838 | Уязвимость файлов services/lfs/server.go и routers/private/serv.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации |
| BDU:2026-15842 | Уязвимость функции DeleteIssueLabel() файла routers/api/v1/repo/issue_label.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-16060 | Уязвимость редактора исходного кода Visual Studio Code, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю обойти существующие механизмы безопасности |
| BDU:2026-16750 | Уязвимость приложения для управления расписанием, онлайн-записью клиентов и встречами Microsoft Bookings, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-17719 | Уязвимость веб-интерфейса платформы для автоматизации BILLmanager 6, связанная с использованием небезопасной прямой ссылки на объект, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
Идентификаторы CVE уязвимостей
Идентификатор, базы данных общеизвестных уязвимостей информационной безопасности
| Идентификатор | Описание |
|---|---|
| CVE-2012-5571 | Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling |
| CVE-2016-20033 | Wowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm_x64.exe |
| CVE-2017-0882 | Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was i... |
| CVE-2017-0920 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in... |
| CVE-2017-0922 | Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsControlle... |
| CVE-2017-0936 | Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A m... |
| CVE-2017-20223 | Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference |
| CVE-2017-3183 | Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authentica... |
| CVE-2018-25129 | SOCA Access Control System 180612 Information Disclosure via Multiple Endpoints |
| CVE-2018-25270 | ThinkPHP 5.0.23 Remote Code Execution via invokefunction |
| CVE-2019-15581 | An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowe... |
| CVE-2019-15582 | An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) tha... |
| CVE-2019-25235 | Smartwares HOME easy 1.0.9 Client-Side Authentication Bypass via Web Pages |
| CVE-2019-25487 | SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmd |
| CVE-2019-5466 | An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names. |
| CVE-2019-5469 | An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to... |
| CVE-2020-16240 | GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerability allows user account... |
| CVE-2020-26068 | Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerability |
| CVE-2020-36895 | EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure |
| CVE-2020-36923 | Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR |
| CVE-2020-37008 | EasyPMS 1.0.0 - Authentication Bypass |
| CVE-2020-37094 | EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords |
| CVE-2020-8154 | An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of ot... |
| CVE-2020-8235 | Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all at... |
| CVE-2020-8297 | Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a d... |
| CVE-2021-21012 | Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure |
| CVE-2021-21022 | Magento Commerce Incorrect permissions Could Lead To Unauthorized Access |
| CVE-2021-21324 | Insecure Direct Object Reference (IDOR) on "Solutions" |
| CVE-2021-22951 | Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior... |
| CVE-2021-22967 | In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to... |
| CVE-2021-24374 | Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak |
| CVE-2021-24473 | User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR |
| CVE-2021-24562 | LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR |
| CVE-2021-24655 | WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise |
| CVE-2021-24739 | Logo Carousel < 3.4.2 - Unauthorised Private Post Access |
| CVE-2021-24800 | DW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDOR |
| CVE-2021-24840 | Squaretype Modern Blog < 3.0.4 - Unauthenticated Private/Schedule Posts Disclosure |
| CVE-2021-24892 | Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR |
| CVE-2021-25096 | IP2Location Country Blocker < 2.26.5 - Ban Bypass |
| CVE-2021-32654 | Attacker can obtain write access to any federated share/public link |
| CVE-2021-32744 | Unauthenticated attacker could gain access to currently open files |
| CVE-2021-36329 | Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malicious u... |
| CVE-2021-36801 | Akaunting Authentication Bypass in Company Selection |
| CVE-2021-37184 | A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could ch... |
| CVE-2021-37628 | File Drop can be bypassed using Richdocuments app in nextcloud |
| CVE-2021-37630 | Secret Circle can be joined without approval in Nextcloud Circles |
| CVE-2021-37631 | Circle can be accessed by non-Circle members in Nextcloud Deck |
| CVE-2021-3852 | Authorization Bypass Through User-Controlled Key in weseek/growi |
| CVE-2021-39225 | Missing permission check on Deck API |
| CVE-2021-3964 | Authorization Bypass Through User-Controlled Key in elgg/elgg |
| CVE-2021-40355 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.... |
| CVE-2021-41111 | Authorization Bypass Through User-Controlled Key in Rundeck |
| CVE-2021-41129 | Authentication bypass in Pterodactyl |
| CVE-2021-4142 | The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an atta... |
| CVE-2021-4226 | RSFirewall < 1.1.25 - IP Block Bypass |
| CVE-2021-43820 | Permissions check bypass in Seafile |
| CVE-2021-44160 | Carinal Tien Hospital Health Report System - Authorization Bypass Through User-Controlled Key |
| CVE-2021-47721 | Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation |
| CVE-2022-0266 | Authorization Bypass Through User-Controlled Key in livehelperchat/livehelperchat |
| CVE-2022-0442 | UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override |
| CVE-2022-0512 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-0613 | Authorization Bypass Through User-Controlled Key in medialize/uri.js |
| CVE-2022-0624 | Authorization Bypass Through User-Controlled Key in ionicabizau/parse-path |
| CVE-2022-0639 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-0686 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-0691 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-1165 | Blackhole for Bad Bots < 3.3.2 - Arbitrary IP Address Blocking via IP Spoofing |
| CVE-2022-1425 | WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR |
| CVE-2022-1579 | Login Block IPs <= 1.0.0 - IP Spoofing Bypass |
| CVE-2022-1580 | Site Offline < 1.5.3 - Access Bypass |
| CVE-2022-1581 | WP-Polls < 2.76.0 - IP Validation Bypass |
| CVE-2022-1600 | YOP Poll < 6.4.3 - IP Spoofing |
| CVE-2022-1613 | Restricted Site Access < 7.3.2 - Access Bypass via IP Spoofing |
| CVE-2022-1614 | WP-Email < 2.69.0 - Anti-Spam Protection Bypass via IP Spoofing |
| CVE-2022-1810 | Authorization Bypass Through User-Controlled Key in publify/publify |
| CVE-2022-1996 | Authorization Bypass Through User-Controlled Key in emicklei/go-restful |
| CVE-2022-2034 | Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API |
| CVE-2022-2080 | Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR |
| CVE-2022-2198 | WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR |
| CVE-2022-23061 | Shopizer - IDOR delete superadmin |
| CVE-2022-2312 | Student Result or Employee Database < 1.7.5 - Stored Cross Site Scripting via CSRF |
| CVE-2022-2367 | WSM Downloader <= 1.4.0 - Domain Name Restriction Bypass |
| CVE-2022-2535 | SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure |
| CVE-2022-2730 | Authorization Bypass Through User-Controlled Key in openemr/openemr |
| CVE-2022-2808 | IDOR in Prens Student Information System |
| CVE-2022-2824 | Authorization Bypass Through User-Controlled Key in openemr/openemr |
| CVE-2022-2877 | Titan Anti-spam & Security < 7.3.1 - Protection Bypass due to IP Spoofing |
| CVE-2022-2913 | Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass |
| CVE-2022-29159 | Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck |
| CVE-2022-31027 | Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator |
| CVE-2022-3282 | Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass |
| CVE-2022-3343 | WPQA < 5.9.3 - Missing validation lead to functionality abuse |
| CVE-2022-33944 | ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key |
| CVE-2022-34150 | ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key |
| CVE-2022-3459 | WooCommerce Multiple Free Gift <= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding |
| CVE-2022-3511 | Awesome Support < 6.1.2 - Subscriber+ Arbitrary Exported Tickets Download |
| CVE-2022-3589 | Miele: Vulnerability in cloud service used by appWash |
| CVE-2022-3794 | Jeg Elementor Kit <= 2.5.6 - Authorization Bypass |
| CVE-2022-3805 | Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass |
| CVE-2022-3846 | Workreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDOR |
| CVE-2022-3891 | WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access |
| CVE-2022-39018 | Broken access controls on PDFtron data in M-Files Hubshare |
| CVE-2022-3930 | Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR |
| CVE-2022-3995 | TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference |
| CVE-2022-4097 | All In One WP Security & Firewall < 5.0.8 - IP Spoofing |
| CVE-2022-4239 | Workreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR |
| CVE-2022-4340 | BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id |
| CVE-2022-43450 | WordPress Stream Plugin <= 3.9.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2022-4417 | WP Cerber < 9.3.3 - User Enumeration Bypass via Rest API |
| CVE-2022-4505 | Authorization Bypass Through User-Controlled Key in openemr/openemr |
| CVE-2022-46179 | LiuOS vulnerable to Authorization Bypass through User-Controlled Key |
| CVE-2022-4686 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4794 | AAWP < 3.12.3 - Unsafe URL Handling |
| CVE-2022-4798 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4799 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4802 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4803 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4806 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4811 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4812 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2023-2172 | BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite |
| CVE-2023-2173 | BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion |
| CVE-2023-23679 | WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (... |
| CVE-2023-2844 | Authorization Bypass Through User-Controlled Key in cloudexplorer-dev/cloudexplorer-lite |
| CVE-2023-2958 | IDOR in ATS Pro |
| CVE-2023-2978 | Abstrium Pydio Cells Change Subscription authorization |
| CVE-2023-3048 | IDOR in TMT's Lockcell |
| CVE-2023-0453 | WP Private Message < 1.0.6 - Private Message Disclosure via IDOR |
| CVE-2023-0550 | Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference |
| CVE-2023-0558 | ContentStudio <= 1.2.5 - Authorization Bypass |
| CVE-2023-0688 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcod... |
| CVE-2023-0689 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shor... |
| CVE-2023-0691 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortco... |
| CVE-2023-0692 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status'... |
| CVE-2023-0693 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id'... |
| CVE-2023-0694 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode |
| CVE-2023-0749 | Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure |
| CVE-2023-1462 | IDOR in Digikent |
| CVE-2023-1463 | Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampass |
| CVE-2023-1889 | Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_tas... |
| CVE-2023-1911 | Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access |
| CVE-2023-2065 | IDOR in Armoli Technology's Cargo Tracking System |
| CVE-2023-22471 | Nextcloud Deck vulnerable to authorization bypass |
| CVE-2023-2260 | Authorization Bypass Through User-Controlled Key in alfio-event/alf.io |
| CVE-2023-25160 | IDOR Vulnerability in Nextcloud Mail |
| CVE-2023-2544 | Authorization Bypass on UPV PEIX |
| CVE-2023-2548 | RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change |
| CVE-2023-26428 | Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context.... |
| CVE-2023-2751 | Upload Resume <= 1.2.0 - Captcha Bypass |
| CVE-2023-28656 | NGINX Management Suite vulnerability |
| CVE-2023-2883 | IDOR in CBOT's Chatbot |
| CVE-2023-30956 | IDOR in Foundry Comments allows retrieval of attachments |
| CVE-2023-30960 | Insecure Direct Object Reference (IDOR) in Foundry job-tracker |
| CVE-2023-0772 | Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure |
| CVE-2023-0865 | WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR |
| CVE-2023-0882 | Authorization Bypass Through User-Controlled Key on Single Connect |
| CVE-2023-0985 | Helmholz and MB Connect Line: Account takeover via password reset in multiple products |
| CVE-2023-2276 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Refe... |
| CVE-2023-24834 | WisdomGarden Tronclass ilearn - Broken Access Control |
| CVE-2023-24842 | HGiga MailSherlock - Broken Access Control |
| CVE-2023-2702 | IDOR in Finex Media's Competition Management System |
| CVE-2023-2713 | IDOR vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform. |
| CVE-2023-3105 | LearnDash LMS <= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change |
| CVE-2023-31182 | EasyTor Applications – Authorization Bypass |
| CVE-2023-3133 | Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API |
| CVE-2023-35914 | WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-35916 | WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-3601 | Simple Author Box < 2.52 - Contributor+ Arbitrary User Information Disclosure via IDOR |
| CVE-2023-37871 | WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-1125 | Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR |
| CVE-2023-1129 | WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR |
| CVE-2023-2190 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2023-28109 | Play With Docker vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2023-30550 | IDOR vulnerability exists in metersphere |
| CVE-2023-3063 | SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Passwo... |
| CVE-2023-3219 | EventON < 2.1.2 - Unauthenticated Post Access via IDOR |
| CVE-2023-32669 | Authorization Bypass on BuddyBoss |
| CVE-2023-32747 | WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-32799 | WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-3285 | A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0 |
| CVE-2023-3286 | A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0 |
| CVE-2023-3287 | A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0 |
| CVE-2023-3288 | A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0 |
| CVE-2023-3700 | Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments |
| CVE-2023-3706 | ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure |
| CVE-2023-3707 | ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure |
| CVE-2023-37242 | Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerabilit... |
| CVE-2023-44154 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis... |
| CVE-2023-45808 | iTop missing silo check on extkey in console and portal |
| CVE-2023-38047 | A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments < 1.5.0. |
| CVE-2023-38048 | A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0 |
| CVE-2023-38049 | A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0 |
| CVE-2023-38050 | A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments < 1.5.0 |
| CVE-2023-38051 | A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments < 1.5.0 |
| CVE-2023-38052 | A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0 |
| CVE-2023-38053 | A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0 |
| CVE-2023-38054 | A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0 |
| CVE-2023-38055 | A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0 |
| CVE-2023-38201 | Keylime: challenge-response protocol bypass during agent registration |
| CVE-2023-3998 | wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease |
| CVE-2023-41796 | WordPress Sunshine Photo Cart Plugin < 3.0.0 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-42455 | Wazuh vulnerable to user privilege escalation |
| CVE-2023-43668 | Apache InLong: Jdbc Connection Security Bypass in InLong |
| CVE-2023-44205 | Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 15... |
| CVE-2023-44206 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis... |
| CVE-2023-44249 | An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before... |
| CVE-2023-32078 | Netmaker IDOR Vulnerability Allows User to Update Other User's Password |
| CVE-2023-32310 | DataEase API interface has IDOR vulnerability |
| CVE-2023-3289 | A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0 |
| CVE-2023-3290 | A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0 |
| CVE-2023-34000 | WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-35876 | WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-36483 | MAS (a Carrier brand) MASmobile Classic Authorization Bypass |
| CVE-2023-36520 | WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-3869 | wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease |
| CVE-2023-40200 | WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability |
| CVE-2023-4023 | All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR |
| CVE-2023-4036 | Simple Blog Card < 1.32 - Subscriber+ Arbitrary Post Access |
| CVE-2023-41368 | Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps) |
| CVE-2023-4213 | Simplr Registration Form Plus+ <= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Pass... |
| CVE-2023-44981 | Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication |
| CVE-2023-46311 | WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-46646 | Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository name... |
| CVE-2023-47543 | An authorization bypass through user-controlled key vulnerability [CWE-639] in Fortinet FortiPortal version 7.0.0 through 7.0... |
| CVE-2023-48304 | Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user |
| CVE-2023-4587 | Insecure direct object reference in ZKTeco ZEM800 |
| CVE-2023-6223 | LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure |
| CVE-2023-6226 | WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure |
| CVE-2023-6824 | WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak |
| CVE-2023-6875 | POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass... |
| CVE-2023-6897 | EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode |
| CVE-2023-6929 | Authorization Bypass Through User-Controlled Key in EuroTel ETL3100 |
| CVE-2023-6969 | User Shortcodes Plus <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclo... |
| CVE-2023-48783 | An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, ve... |
| CVE-2023-49251 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of... |
| CVE-2023-4934 | IDOR in Usta AYBS |
| CVE-2023-50267 | MeterSphere horizontal privilege escalation vulnerability of resources in project scope. |
| CVE-2023-51502 | WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-51503 | WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-6317 | PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction |
| CVE-2023-6341 | Catalis CM360 allows authentication bypass |
| CVE-2023-6384 | WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR |
| CVE-2024-0264 | SourceCodester Clinic Queuing System LoginRegistration.php authorization |
| CVE-2024-1075 | Minimal Coming Soon – Coming Soon Page <= 2.37 - Unauthenticated Maintenance Mode Bypass |
| CVE-2024-10770 | Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10775 | Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10777 | AnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10778 | BuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10779 | Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10780 | Restaurant & Cafe Addon for Elementor <= 1.5.9 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10782 | Theme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10787 | LA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2023-44254 | An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 a... |
| CVE-2023-49765 | WordPress Rate my Post – WP Rating System Plugin <= 3.4.1 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-49812 | WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-53914 | UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability |
| CVE-2023-53930 | ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability |
| CVE-2023-53955 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References |
| CVE-2023-6504 | Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode |
| CVE-2023-6506 | WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending |
| CVE-2023-6515 | IDOR in Mia Technology's Mia-Med |
| CVE-2023-6523 | IDOR in ExtremePacs's Extreme XDS |
| CVE-2023-7049 | Custom Field For WP Job Manager <= 1.2 - Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode |
| CVE-2023-7198 | WPDashboardNotes < 1.0.11 - Unauthorised Deletion of Private Notes |
| CVE-2023-7199 | Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure |
| CVE-2023-7239 | wp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR |
| CVE-2023-7252 | Tickera < 3.5.2.5 - Ticket leakage through IDOR |
| CVE-2023-7286 | ACF Quick Edit Fields <= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference |
| CVE-2024-0421 | MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure |
| CVE-2024-10075 | Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution |
| CVE-2024-10098 | ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access |
| CVE-2024-10366 | IDOR in delete attachments in danny-avila/librechat |
| CVE-2023-38513 | WordPress Photo Engine Plugin <= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-40720 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0... |
| CVE-2023-4099 | Multiple vulnerabilities in IDM Sistemas QSige |
| CVE-2023-4101 | Multiple vulnerabilities in IDM Sistemas QSige |
| CVE-2023-47191 | WordPress Youzify Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-4836 | WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR |
| CVE-2023-5922 | Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read |
| CVE-2023-6144 | Dev Blog v1.0 - ATO |
| CVE-2023-6724 | IDOR in Simgesel Software's Hearing Tracking System (Barosel) |
| CVE-2024-0580 | Omission of key-controlled authorization in Qsige |
| CVE-2024-0839 | FeedWordPress <= 2022.0222 - Insecure Direct Object Referece |
| CVE-2024-0872 | Watu Quiz <= 3.4.1 - Sensitive Information Disclosure |
| CVE-2024-10121 | wfh45678 Radar Interface authorization |
| CVE-2024-10174 | WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure D... |
| CVE-2024-10215 | WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change |
| CVE-2024-10497 | CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to mod... |
| CVE-2024-10654 | TOTOLINK LR350 formLoginAuth.htm authorization |
| CVE-2024-10666 | Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure |
| CVE-2024-10667 | Content Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Discl... |
| CVE-2024-10669 | Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10670 | Primary Addon for Elementor <= 1.6.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10671 | Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10688 | Attesa Extra <= 1.4.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10689 | XLTab – Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10690 | Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10692 | PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.8.1 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10693 | SKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10695 | Futurio Extra <= 2.0.13 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10696 | UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor S... |
| CVE-2024-11275 | WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authen... |
| CVE-2024-11284 | WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover |
| CVE-2024-11285 | WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover |
| CVE-2024-11300 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-11318 | IDOR vulnerability in AbsysNet |
| CVE-2024-12447 | Get Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Di... |
| CVE-2024-10794 | Boostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10795 | Popularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10796 | If-So Dynamic Content Personalization <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10797 | Full Screen Menu for Elementor <= 1.0.7 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10798 | Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10925 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-11146 | TrueFiling authorization bypass via user-controlled keys |
| CVE-2024-11167 | Improper Access Control in danny-avila/librechat |
| CVE-2024-11181 | Greenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-11216 | Broken Access Control in PozitifIK's Pik Online |
| CVE-2024-11915 | RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12305 | Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform |
| CVE-2024-12306 | Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform |
| CVE-2024-12309 | Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts |
| CVE-2024-12335 | Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2024-12472 | Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2024-12483 | Dromara UJCMS User ID id authorization |
| CVE-2024-12767 | BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR |
| CVE-2024-1295 | The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Access |
| CVE-2024-13040 | Quanta Computer QOCA aim - Authorization Bypass |
| CVE-2024-13063 | IDOR in Akinsoft's MyRezzta |
| CVE-2024-13407 | Omnipress <= 1.5.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-13425 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion |
| CVE-2024-13428 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion |
| CVE-2024-13429 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion |
| CVE-2024-13607 | JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Referenc... |
| CVE-2024-13873 | WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection |
| CVE-2024-13887 | Business Directory Plugin - Easy Listing Directories for WordPress <= 6.4.14 - Insecure Direct Object Reference to Listing Ar... |
| CVE-2024-1693 | SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update |
| CVE-2024-1744 | IDOR in Ariva Computer's Accord ORS |
| CVE-2024-20513 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices co... |
| CVE-2024-22206 | @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) |
| CVE-2024-22305 | WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object Referen... |
| CVE-2024-2231 | Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDOR |
| CVE-2024-10439 | Sunnet eHRD CTMS - Insecure Direct Object Reference |
| CVE-2024-10452 | Organization admins can delete pending invites created in an organization they are not part of. |
| CVE-2024-10855 | Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Del... |
| CVE-2024-10868 | Enter Addons – Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-1107 | IDOR in Talya Informatics' Travel APPS |
| CVE-2024-11137 | IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary |
| CVE-2024-12046 | Medical Addon for Elementor <= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information... |
| CVE-2024-12059 | ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read |
| CVE-2024-12061 | Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12062 | Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12099 | Dollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12102 | Typer Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12103 | Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosure |
| CVE-2024-12114 | FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Referen... |
| CVE-2024-12116 | Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12131 | WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure... |
| CVE-2024-12812 | WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information |
| CVE-2024-1286 | Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure |
| CVE-2024-12880 | Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow |
| CVE-2024-1313 | Users outside an organization can delete a snapshot with its key |
| CVE-2024-13175 | IDOR in Vidco Software's VOC TESTER |
| CVE-2024-1330 | Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access |
| CVE-2024-13372 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download |
| CVE-2024-13558 | NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Discl... |
| CVE-2024-13601 | Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direc... |
| CVE-2024-13740 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscribe... |
| CVE-2024-13832 | Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure |
| CVE-2024-13841 | Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time <= 1.0.0 - Authenticated (Contributor+) Post Disc... |
| CVE-2024-21759 | An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 a... |
| CVE-2024-22455 | Dell Mobility - E-Lab Navigator, version(s) 3.1.9, 3.2.0, contain(s) an Authorization Bypass Through User-Controlled Key vuln... |
| CVE-2024-2261 | Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure |
| CVE-2024-23112 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 thr... |
| CVE-2024-2472 | LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR |
| CVE-2024-25983 | Msa-24-0006: idor on dashboard comments block |
| CVE-2024-29024 | JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality |
| CVE-2024-31291 | WordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerability |
| CVE-2024-31296 | WordPress BookingPress plugin <= 1.0.81 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-32772 | WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-32808 | WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability |
| CVE-2024-27302 | Authorization Bypass Through User-Controlled Key in go-zero |
| CVE-2024-29020 | JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked |
| CVE-2024-29181 | @strapi/plugin-content-manager leaks data via relations via the Admin Panel |
| CVE-2024-29194 | OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation |
| CVE-2024-3035 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-30507 | WordPress Molongui Authorship plugin <= 4.7.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-30513 | WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-30543 | WordPress Whizzy plugin <= 1.1.18 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-31095 | WordPress Thumbs Rating plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-31898 | IBM InfoSphere Information Server data modification |
| CVE-2024-32604 | WordPress WP-Recall plugin <= 16.26.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-32683 | WordPress WP Ultimate Review plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-3305 | IDOR in Utarit Information's SoliClub |
| CVE-2024-3306 | IDOR in Utarit Information's SoliClub |
| CVE-2024-33542 | WordPress Crelly Slider plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-34383 | WordPress SEOPress plugin <= 7.7.1 - Sensitive Data Exposure vulnerability |
| CVE-2024-34457 | Apache StreamPark IDOR Vulnerability |
| CVE-2024-38701 | WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability |
| CVE-2024-39319 | aimeos/ai-controller-frontend has IDOR vulnerability in account profile page |
| CVE-2024-39321 | Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes |
| CVE-2024-39642 | WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-12132 | WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecur... |
| CVE-2024-1470 | Elevation of Privilege attack on NetIQ Client login extension |
| CVE-2024-1604 | Incorrect authorization in BMC Control-M |
| CVE-2024-1625 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-1626 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-1640 | Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form <= 2.10.1 - Unauth... |
| CVE-2024-22439 | Certain HPE FlexNetwork and FlexFabric Switches, Remote Authentication Bypass |
| CVE-2024-2346 | FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference |
| CVE-2024-2441 | VikBooking < 1.6.8 - Insecure Direct Object References |
| CVE-2024-2538 | Permalink Manager <= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification |
| CVE-2024-2543 | Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor |
| CVE-2024-2574 | SourceCodester Employee Task Management System edit-task.php authorization |
| CVE-2024-2575 | SourceCodester Employee Task Management System task-details.php authorization |
| CVE-2024-2576 | SourceCodester Employee Task Management System update-admin.php authorization |
| CVE-2024-2577 | SourceCodester Employee Task Management System update-employee.php authorization |
| CVE-2024-36399 | Kanboard affected by Project Takeover via IDOR in ProjectPermissionController |
| CVE-2024-3748 | SP Project & Document Manager <= 4.71 - Data Update via IDOR |
| CVE-2024-3749 | SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR |
| CVE-2024-37889 | MyFinances Allows Unauthorized Access to Other Customer Data |
| CVE-2024-42169 | HCL MyXalytics is affected by insecure direct object references |
| CVE-2024-42422 | Dell NetWorker, version(s) 19.10, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability. An unauthenti... |
| CVE-2024-42463 | Leak of organizations messages |
| CVE-2024-39897 | Cache driver GetBlob() allows read access to any blob without access control check |
| CVE-2024-39900 | OpenSearch Dashboards Reports does not properly restrict access to private tenant resources |
| CVE-2024-39901 | OpenSearch Observability does not properly restrict access to private tenant resources |
| CVE-2024-43239 | WordPress Masteriyo LMS plugin <= 1.11.4 - Insecure Direct Object Reference (IDOR) vulnerability |
| CVE-2024-43266 | WordPress WP Job Portal plugin <= 2.1.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43288 | WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43315 | WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43322 | WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-45329 | A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and... |
| CVE-2024-4537 | IDOR vulnerability in Janto Ticketing Software |
| CVE-2024-4538 | IDOR vulnerability in Janto Ticketing Software |
| CVE-2024-45605 | Improper authorization on deletion of user issue alert notifications in sentry |
| CVE-2024-45606 | Improper authorization on muting of alert rules in sentry |
| CVE-2024-45614 | Header normalization allows for client to clobber proxy set headers in Puma |
| CVE-2024-4565 | Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access |
| CVE-2024-45786 | Improper Authorization Vulnerability |
| CVE-2024-45806 | Potential manipulate `x-envoy` headers from external sources in envoy |
| CVE-2024-47495 | Junos OS Evolved: In a dual-RE scenario a locally authenticated attacker with shell privileges can take over the device. |
| CVE-2024-47657 | Improper Access Control Vulnerability |
| CVE-2024-4886 | BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR |
| CVE-2024-49388 | Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect... |
| CVE-2024-5128 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-5130 | Incorrect Authorization in lunary-ai/lunary |
| CVE-2024-5131 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-5166 | Insecure Direct Object Reference In Looker |
| CVE-2024-52294 | khoj has an IDOR in subscription management that allows unauthorized subscription modifications |
| CVE-2024-52313 | data.all authenticated users can obtain incorrect object level authorizations |
| CVE-2024-5333 | The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure |
| CVE-2024-5639 | User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update |
| CVE-2024-6357 | Insecure Direct Object Reference vulnerability |
| CVE-2024-6410 | ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference |
| CVE-2024-6685 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-7473 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-7474 | IDOR in lunary-ai/lunary |
| CVE-2024-7476 | Broken Access Control in lunary-ai/lunary |
| CVE-2024-8040 | Authorization Bypass Through User-Controlled Key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x |
| CVE-2024-8428 | ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privileg... |
| CVE-2024-8485 | REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover |
| CVE-2024-8601 | Improper Access Control Vulnerability in TechExcel Back Office Software |
| CVE-2024-8613 | Improper Access Control in gaizhenbiao/chuanhuchatgpt |
| CVE-2024-8988 | PeepSo Core: File Uploads <= 6.4.6.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via... |
| CVE-2024-9097 | IDOR |
| CVE-2024-9262 | User Meta – User Profile Builder and User management plugin <= 3.1.1 - Insecure Direct Object Reference to Sensitive Informat... |
| CVE-2024-9263 | WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Referenc... |
| CVE-2024-9554 | Sovell Smart Canteen System Password Reset suanfa.py Check_ET_CheckPwdz201 authorization |
| CVE-2024-9617 | IDOR in danswer-ai/danswer |
| CVE-2025-0058 | Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow |
| CVE-2025-0337 | Authorization bypass in Now Platform |
| CVE-2025-0352 | Rapid Response Monitoring My Security Account App Authorization Bypass Through User-Controlled Key |
| CVE-2024-42464 | Leak of user information |
| CVE-2024-4274 | Essential Real Estate <= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletion |
| CVE-2024-4279 | Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to A... |
| CVE-2024-43350 | WordPress Propovoice CRM plugin <= 1.7.6.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-4341 | IDOR in ExtremePacs's Extreme XDS |
| CVE-2024-4464 | Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680,... |
| CVE-2024-45032 | A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Vir... |
| CVE-2024-46982 | Cache Poisoning in next.js |
| CVE-2024-4750 | BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment |
| CVE-2024-50395 | Media Streaming add-on |
| CVE-2024-50483 | WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability |
| CVE-2024-52507 | Share information of the Nextcloud Tables app is not limited to affected users |
| CVE-2024-52511 | Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables |
| CVE-2024-5258 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-52601 | iTop portal Insecure Direct Object Reference vulnerability |
| CVE-2024-56143 | Strapi Allows Unauthorized Access to Private Fields via parms.lookup |
| CVE-2024-5619 | IDOR in PruvaSoft Informatics' Apinizer Management Console |
| CVE-2024-6087 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-6534 | Directus 10.13.0 - Insecure object reference via PATH presets |
| CVE-2024-7040 | Без описания... |
| CVE-2024-7041 | IDOR in open-webui/open-webui |
| CVE-2024-7848 | User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access |
| CVE-2024-8261 | IDOR in Proliz Software's OBS |
| CVE-2024-8290 | WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Obje... |
| CVE-2024-8292 | WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary... |
| CVE-2024-9637 | School Management System – WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Tak... |
| CVE-2024-9687 | WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass |
| CVE-2024-9700 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submissio... |
| CVE-2025-0606 | IDOR in Logo Software's Logo Cloud |
| CVE-2025-0875 | IDOR in Proliz Software's OBS |
| CVE-2025-10493 | Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie |
| CVE-2025-10570 | Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary O... |
| CVE-2024-32823 | WordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-35659 | WordPress KiviCare plugin <= 3.6.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-37277 | WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-38827 | Spring Security Authorization Bypass for Case Sensitive Comparisons |
| CVE-2024-4151 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-4154 | Incorrect Synchronization in lunary-ai/lunary |
| CVE-2024-43916 | WordPress Zephyr Project Manager plugin <= 3.3.102 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-4665 | EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update |
| CVE-2024-47316 | WordPress Salon Booking Wordpress Plugin plugin <= 10.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-4843 | ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a le... |
| CVE-2024-4873 | Replace Image <= 1.1.10 - Insecure Direct Object Reference |
| CVE-2024-4874 | Bricks Builder <= 1.9.8 - Insecure Direct Object Reference |
| CVE-2024-51559 | Improper Access Control Vulnerability in Wave 2.0 |
| CVE-2024-5438 | Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to A... |
| CVE-2024-5942 | Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure |
| CVE-2024-5973 | MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor |
| CVE-2024-5977 | GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worke... |
| CVE-2024-8123 | The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference |
| CVE-2024-8158 | User impersonation for lib9p based 9p fileservers |
| CVE-2024-8791 | Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Ref... |
| CVE-2024-9215 | Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object R... |
| CVE-2024-9819 | IDOR in NextGEO's NG Analyser |
| CVE-2024-9862 | Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change |
| CVE-2025-0987 | IDOR in CB Project's CVLand |
| CVE-2025-10005 | Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protect... |
| CVE-2025-10019 | WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-10024 | IDOR in EXERT Computer Technologies' Education Management System |
| CVE-2025-10039 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference v... |
| CVE-2025-10719 | WisdomGarden｜Tronclass - Insecure Direct Object Reference |
| CVE-2025-10720 | WP Private Content Plus <= 3.6.2 - Password Protection Bypass |
| CVE-2025-10742 | Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change |
| CVE-2025-11690 | IDOR vulnerability in the CFMOTO RIDE API |
| CVE-2025-12071 | Frontend User Notes <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification |
| CVE-2025-12086 | Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund... |
| CVE-2025-12087 | Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishl... |
| CVE-2025-12126 | The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation |
| CVE-2025-0640 | IDOR in Akinsoft's OctoCloud |
| CVE-2025-0642 | Hard-coded Credentials in PosCube's Assist |
| CVE-2025-0661 | DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2025-0670 | IDOR in Akinsoft's ProKuafor |
| CVE-2025-1031 | IDOR in Utarit Informatics' SoliClub |
| CVE-2025-10855 | IDOR in Solvera Software's Teknoera |
| CVE-2025-11127 | Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation |
| CVE-2025-11176 | Quick Featured Images <= 13.7.2 - Insecure Direct Object Reference to Image Manipulation |
| CVE-2025-11517 | Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass |
| CVE-2025-11518 | WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation |
| CVE-2025-11519 | Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload |
| CVE-2025-11532 | Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation |
| CVE-2025-11741 | WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure |
| CVE-2025-11748 | Groups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join |
| CVE-2025-11895 | Binary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference |
| CVE-2025-11924 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Se... |
| CVE-2025-11957 | Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated... |
| CVE-2025-12008 | IDOR in APPYAP's Yaay Social Media App |
| CVE-2025-12030 | ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification |
| CVE-2025-12040 | Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation |
| CVE-2025-12063 | An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appr... |
| CVE-2025-12283 | code-projects Client Details System authorization |
| CVE-2025-12288 | Bdtask Pharmacy Management System User Profile edit_user authorization |
| CVE-2025-12623 | fushengqian fuint Authentication Token ClientSignController.java authorization |
| CVE-2025-1270 | Insecure direct object reference (IDOR) vulnerability in H6Web |
| CVE-2025-13109 | HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Referenc... |
| CVE-2025-13110 | HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Referenc... |
| CVE-2025-13124 | IDOR in Netiket''s ApplyLogic |
| CVE-2025-13125 | IDOR in Im Park's DijiDemi |
| CVE-2025-13157 | QODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update |
| CVE-2025-13382 | Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renamin... |
| CVE-2025-13389 | Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Informat... |
| CVE-2025-13615 | StreamTube Core <= 4.78 - Unauthenticated Arbitrary User Password Change |
| CVE-2025-13748 | Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id |
| CVE-2025-13768 | Uniong｜WebITR - Authorization Bypass |
| CVE-2025-13822 | Authentication bypass in MCPHub |
| CVE-2025-13842 | Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure |
| CVE-2025-13874 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-13932 | The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR... |
| CVE-2025-14033 | ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure |
| CVE-2025-14073 | WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure |
| CVE-2025-14101 | IDOR in GG Soft's PaperWork |
| CVE-2025-14356 | Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission... |
| CVE-2025-14459 | Virt-cdi-controller: unauthorized pvc cloning via dataimportcron |
| CVE-2025-14594 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-1469 | IDOR in Turtek Software's Eyotek |
| CVE-2025-14881 | Insecure direct object reference |
| CVE-2025-14882 | Insecure direct object reference |
| CVE-2025-14974 | IBM InfoSphere Information Server is vulnerable due to Insecure Direct Object Reference |
| CVE-2025-14996 | AS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-14998 | Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Take... |
| CVE-2025-15001 | FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-15018 | Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover |
| CVE-2025-15025 | IDOR in Yordam Informatics' Library Automation System |
| CVE-2025-15033 | WooCommerce - Subscriber/Customer+ Order Data Disclosure |
| CVE-2025-1667 | School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover |
| CVE-2025-20114 | Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability |
| CVE-2025-22695 | WordPress Nirweb support plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2025-2271 | IDOR in Issuetrak NewAuditID parameter via Inv_PopTrakXShow.asp |
| CVE-2025-10759 | Webkul QloApps CSRF Token authorization |
| CVE-2025-10910 | Gaining remote control over Govee devices |
| CVE-2025-10912 | IDOR in saastech.io's TemizlikYolda |
| CVE-2025-10947 | Sistemas Pleno Gestão de Locação CPF validarCpf authorization |
| CVE-2025-11247 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-11321 | zhuimengshaonian wisdom-education WrongBookController.java authorization |
| CVE-2025-12351 | Inadequate access control measure allows unauthorized users to access restricted administrative functions |
| CVE-2025-12353 | WPFunnels <= 3.6.2 - Unauthorized User Registration |
| CVE-2025-12366 | Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference |
| CVE-2025-12427 | YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename |
| CVE-2025-12524 | Post Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change |
| CVE-2025-12954 | Timetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR |
| CVE-2025-12997 | Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with acce... |
| CVE-2025-13003 | IDOR in Aksis Computer's AxOnboard |
| CVE-2025-13004 | IDOR in Farktor Software's E-Commerce Package |
| CVE-2025-1327 | Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitr... |
| CVE-2025-13452 | Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Imp... |
| CVE-2025-13457 | WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token... |
| CVE-2025-13471 | User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update |
| CVE-2025-13474 | IDOR in Menulux Software's Mobile App |
| CVE-2025-13479 | IDOR in PosCube's QR Menu |
| CVE-2025-14742 | WP Recipe Maker <= 10.2.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure |
| CVE-2025-14772 | Broken Access Control in ABB T-MAC Plus web application |
| CVE-2025-14802 | LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Materi... |
| CVE-2025-14844 | Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Inf... |
| CVE-2025-15147 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update... |
| CVE-2025-15521 | Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Accoun... |
| CVE-2025-1607 | SourceCodester Best Employee Management System salary_slip.php authorization |
| CVE-2025-2301 | IDOR in Akbim Software's Online Exam Registration |
| CVE-2025-24315 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-24850 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-26788 | StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction. |
| CVE-2025-26857 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27433 | Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) |
| CVE-2025-27436 | Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) |
| CVE-2025-27927 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27929 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27938 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27939 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-28874 | WordPress BP Email Assign Templates By shanebp plugin <= 1.7 - Arbitrary Content Deletion vulnerability |
| CVE-2025-30254 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-12766 | Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of affected versions of BlackBerry AtHoc. |
| CVE-2025-12833 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authentic... |
| CVE-2025-1284 | Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference t... |
| CVE-2025-12854 | newbee-mall-plus seckillExecution executeSeckill authorization |
| CVE-2025-12881 | Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitra... |
| CVE-2025-12883 | Campay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment Bypass |
| CVE-2025-12903 | Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud |
| CVE-2025-15096 | Videospirecore Theme Plugin <= 1.0.6 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeove... |
| CVE-2025-15370 | Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator |
| CVE-2025-15582 | detronetdip E-commerce Product Management Update authorization |
| CVE-2025-15626 | Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application |
| CVE-2025-15657 | WordPress School Management plugin <= 93.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-20214 | A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticat... |
| CVE-2025-24969 | iTop portal user can see any other contact's picture |
| CVE-2025-24976 | Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT |
| CVE-2025-26660 | Broken Access Control in SAP Fiori apps (Posting Library) |
| CVE-2025-26965 | WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-26977 | WordPress FileBird plugin <= 6.4.2.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-27507 | IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations |
| CVE-2025-27561 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27565 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27568 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27575 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27719 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-30514 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-3091 | MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24 |
| CVE-2025-31950 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31997 | HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2025-32223 | WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-32373 | DNN allows a registered user to enumerate and access files they should not have access to |
| CVE-2025-32781 | Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId |
| CVE-2025-3281 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Ref... |
| CVE-2025-34140 | ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix |
| CVE-2025-34293 | GN4 Publishing System Insecure Direct Object Reference (IDOR) Information Disclosure |
| CVE-2025-34435 | AVideo < 20.1 IDOR Arbitrary File Deletion |
| CVE-2025-34436 | AVideo < 20.1 IDOR Arbitrary File Upload |
| CVE-2025-34437 | AVideo < 20.1 IDOR Arbitrary Comment Image Upload |
| CVE-2025-34438 | AVideo < 20.1 IDOR Arbitrary Video Rotation |
| CVE-2025-3769 | Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference |
| CVE-2025-3810 | WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-3811 | WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update |
| CVE-2025-39434 | WordPress Avatar plugin <= 0.1.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-39537 | WordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability |
| CVE-2025-4040 | IDOR in Turpak's Automatic Station Monitoring System |
| CVE-2025-40773 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broke... |
| CVE-2025-40805 | Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthentica... |
| CVE-2025-4129 | IDOR in PAVO Inc.'s PAVO Pay |
| CVE-2025-41358 | Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A |
| CVE-2025-4210 | Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization |
| CVE-2025-43724 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability... |
| CVE-2025-43732 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1... |
| CVE-2025-4596 | Information disclosure via IDOR in Asseco AMDX |
| CVE-2025-46386 | CWE-639 Authorization Bypass Through User-Controlled Key |
| CVE-2025-46387 | CWE-639 Authorization Bypass Through User-Controlled Key |
| CVE-2025-30257 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-3089 | Broken Access Control in ServiceNow AI Platform |
| CVE-2025-31357 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31360 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31833 | WordPress JobBoard Job listing plugin Plugin <= 1.2.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-31867 | WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-31933 | Growatt Cloud Applications Authorization Bypass Through User-Controlled Key |
| CVE-2025-31941 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31945 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31949 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-3574 | Insecure Direct Object Reference on Deporsite by T-INNOVA |
| CVE-2025-3575 | Insecure Direct Object Reference en Deporsite de T-INNOVA |
| CVE-2025-36023 | IBM Cloud Pak for Business Automation security bypass |
| CVE-2025-3605 | Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-3610 | Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update |
| CVE-2025-3625 | Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action |
| CVE-2025-3853 | WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Gene... |
| CVE-2025-3874 | WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference |
| CVE-2025-3889 | WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity' |
| CVE-2025-40650 | Insecure Direct Object Reference (IDOR) in Clickedu |
| CVE-2025-40658 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40659 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40660 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40661 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40676 | Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC |
| CVE-2025-42605 | Improper Access Control Vulnerability in Meon Bidding Solutions |
| CVE-2025-43782 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 th... |
| CVE-2025-22608 | Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) |
| CVE-2025-24487 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-2526 | Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover |
| CVE-2025-25276 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-25282 | Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow |
| CVE-2025-2563 | User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation |
| CVE-2025-2594 | User Registration & Membership < 4.1.3 - Authentication Bypass |
| CVE-2025-30777 | WordPress Support Genix plugin <= 1.4.11 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-31147 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31654 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-3282 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Ref... |
| CVE-2025-3292 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Ref... |
| CVE-2025-3519 | Replace uploaded files knowing the file upload ID |
| CVE-2025-3636 | Moodle: idor in moodle rss block allows unauthorized access to rss feeds |
| CVE-2025-36365 | IBM Db2 Privilege Escalation |
| CVE-2025-3640 | Moodle: idor in web service allows users enrolled in a course to access some details of other users |
| CVE-2025-41020 | Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito |
| CVE-2025-41069 | Insecure Direct Object References (IDOR) in DeporSite of T-Innova DeporSite |
| CVE-2025-41077 | Multiple vulnerabilities in Viafirma products |
| CVE-2025-41086 | Authorization bypass in GAMS from GAMS Development Corp. |
| CVE-2025-41091 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41092 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41093 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41094 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41095 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41096 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41097 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41098 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41099 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-5261 | IDOR in PozitifIK's Pik Online |
| CVE-2025-47555 | WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-4796 | Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover |
| CVE-2025-4855 | Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key |
| CVE-2025-49334 | WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-49352 | WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerabil... |
| CVE-2025-49952 | WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-49978 | WordPress JobSearch plugin < 3.0.6 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-49995 | WordPress Download Attachments plugin <= 1.3.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-5182 | Summer Pearl Group Vacation Rental Management Platform Listing authorization |
| CVE-2025-5195 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-52446 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api mo... |
| CVE-2025-52447 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sq... |
| CVE-2025-52448 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initi... |
| CVE-2025-53357 | GLPI permits reservation modification by unauthorized users |
| CVE-2025-5518 | IDOR in ArgusTech's BILGER |
| CVE-2025-5681 | IDOR in Turtek Software's Eyotek |
| CVE-2025-43790 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 th... |
| CVE-2025-43803 | Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119... |
| CVE-2025-43810 | Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, an... |
| CVE-2025-43827 | Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older... |
| CVE-2025-4691 | Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to... |
| CVE-2025-49135 | CVAT missing validation for in-progress backup upload names |
| CVE-2025-53208 | WordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-53640 | Indico vulnerable to user enumeration via API endpoint |
| CVE-2025-54691 | WordPress Motors Plugin plugin <= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-5526 | BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update |
| CVE-2025-57886 | WordPress Accessibility Checker by Equalize Digital Plugin <= 1.30.0 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-58597 | WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-58627 | WordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-59133 | WordPress Projectopia plugin <= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-6038 | Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privi... |
| CVE-2025-61950 | In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly... |
| CVE-2025-62241 | Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allo... |
| CVE-2025-55737 | flaskBlog arbitrary comment delete |
| CVE-2025-57994 | WordPress Upcoming Events Lists Plugin <= 1.4.0 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-58012 | WordPress Content Mask plugin <= 1.8.5.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-58055 | Discourse AI Suggestions Contain Insecure Direct Object Reference |
| CVE-2025-58137 | Apache Fineract: IDOR via self-service API |
| CVE-2025-58402 | Insecure Direct Object Reference Message ID |
| CVE-2025-59034 | Indico may disclose unauthorized user details access via legacy API |
| CVE-2025-61779 | Trustee's attestation-policy endpoint is not protected by admin autentication |
| CVE-2025-62166 | FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens |
| CVE-2025-62180 | Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated u... |
| CVE-2025-63043 | WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-63053 | WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-63065 | WordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerability |
| CVE-2025-6329 | ScriptAndTools Real Estate Management System User Delete userdelete.php authorization |
| CVE-2025-64706 | Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure |
| CVE-2025-6574 | Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover |
| CVE-2025-5947 | Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie |
| CVE-2025-5948 | Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business |
| CVE-2025-5949 | Service Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password |
| CVE-2025-59562 | WordPress Academy LMS Plugin <= 3.3.4 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-64282 | WordPress Radius Blocks plugin <= 2.2.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-64283 | WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-65020 | Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR) |
| CVE-2025-65021 | Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR) |
| CVE-2025-65028 | Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes |
| CVE-2025-65029 | Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants |
| CVE-2025-65030 | Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal |
| CVE-2025-65031 | Rallly Improper Authorization in Comment Endpoint Allows User Impersonation |
| CVE-2025-65032 | Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names |
| CVE-2025-65033 | Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation |
| CVE-2025-65034 | Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId |
| CVE-2025-65096 | RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections |
| CVE-2025-65097 | Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections |
| CVE-2025-65098 | Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass |
| CVE-2025-66286 | Webkitgtk: authorization bypass through webpage::send-request signal handler |
| CVE-2025-66306 | Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel |
| CVE-2025-66558 | Nextcloud Twofactor WebAuthn app was updated based on public key |
| CVE-2025-67594 | WordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-67909 | WordPress Membership For WooCommerce plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-67919 | WordPress Woffice Core plugin <= 5.4.30 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-67985 | WordPress Document Library Lite plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68044 | WordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68051 | WordPress Shiprocket plugin <= 2.0.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68071 | WordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68492 | Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerabi... |
| CVE-2025-68502 | WordPress JetPopup plugin <= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68514 | WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69029 | WordPress Struktur theme <= 2.5.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69030 | WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69032 | WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69202 | axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header |
| CVE-2025-69347 | WordPress WPSubscription plugin <= 1.8.10 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69394 | WordPress Cnvrse plugin < 026.02.10.20 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-6942 | The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an... |
| CVE-2025-71388 | stoatchat 20241213-1 Webhook Token Disclosure via Read Permissions |
| CVE-2025-71400 | better-auth passkey before 1.4.0 IDOR via delete-passkey |
| CVE-2025-71420 | UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply |
| CVE-2025-7718 | Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Refere... |
| CVE-2025-7899 | Insecure Direct Object Reference in extension "powermail" (powermail) |
| CVE-2025-7900 | Insecure Direct Object Reference in extension "femanager" (femanager) |
| CVE-2025-7938 | jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java updateGoods authorization |
| CVE-2025-8755 | macrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorization |
| CVE-2025-8770 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-8789 | Portabilis i-Educar API Endpoint Diario authorization |
| CVE-2025-8794 | LitmusChaos Litmus LocalStorage authorization |
| CVE-2025-9114 | Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change |
| CVE-2025-9342 | IDOR in Anadolu Hayat Emeklilik's AHE Mobile |
| CVE-2025-62242 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and... |
| CVE-2025-62244 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay... |
| CVE-2025-62252 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versio... |
| CVE-2025-62893 | Без описания... |
| CVE-2025-64105 | FOSSBilling: IDOR Vulnerability in Support Ticket Creation |
| CVE-2025-64431 | IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering |
| CVE-2025-64497 | Tuleap exposes releases for all projects to File Release System project administrators |
| CVE-2025-64516 | GLPI incorrectly authorizes access to documents |
| CVE-2025-64523 | FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function |
| CVE-2025-6833 | All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authen... |
| CVE-2025-68975 | WordPress Eagle Booking plugin <= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68979 | WordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68997 | WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69207 | Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning |
| CVE-2025-69274 | Spectrum broken authorization scheme |
| CVE-2025-7347 | IDOR in Dinibh Puzzle's Dinibh Patrol Tracking System |
| CVE-2025-7355 | IDOR in Beefull Energy Technologies' Beefull App |
| CVE-2025-66123 | WordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-66132 | WordPress FAPI Member plugin <= 2.2.30 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-66513 | Nextcloud Tables app share information not limited to relevant users |
| CVE-2025-66546 | Nextcloud Calendar app allowed booking appointments without the generated token |
| CVE-2025-66547 | Nextcloud Server users can modify tags on files that do not belong to them |
| CVE-2025-66551 | Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users |
| CVE-2025-66553 | Nextcloud Tables app allowed users to view columns metadata information of any table |
| CVE-2025-66556 | Nextcloud talk allows participants to blindly delete poll drafts of other users by ID |
| CVE-2025-7013 | IDOR in QRMenumPro's Menu Panel |
| CVE-2025-7049 | WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover |
| CVE-2025-8532 | IDOR in Bimser's eBA Document and Workflow Management System |
| CVE-2025-9062 | IDOR in MeCODE Informatics' Envanty |
| CVE-2025-9081 | IDOR in board file download allows any user to download any file by UUID |
| CVE-2026-0909 | WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Paramet... |
| CVE-2023-6983 | Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Insecure Direct Object Reference to Authentic... |
| CVE-2025-9835 | macrozheng mall cancelUserOrder cancelOrder authorization |
| CVE-2025-9836 | macrozheng mall paySuccess authorization |
| CVE-2025-9902 | IDOR in Akınsoft QRMenu |
| CVE-2026-100579 | OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester |
| CVE-2026-100609 | Flowise through 3.1.4 Insecure Direct Object Reference via Credential |
| CVE-2026-100610 | Flowise through 3.1.4 Missing Authorization via upsert-history |
| CVE-2026-100612 | Capgo SSO Provider ID Authentication Bypass via Incomplete Migration |
| CVE-2026-100614 | Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker |
| CVE-2026-100618 | Capgo App Icon Update Privilege Escalation via Service-Role Worker |
| CVE-2026-100626 | capgo through 12.128.2 IDOR via PUT /app icon endpoint |
| CVE-2026-100627 | Capgo bundle promotion API channel RBAC deny override bypass |
| CVE-2026-100670 | Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass |
| CVE-2026-100679 | stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket |
| CVE-2026-100688 | Budibase server before 3.45.0 Cross-Tenant Information Disclosure |
| CVE-2026-10103 | Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels |
| CVE-2026-101033 | KitchenOwl through 0.7.10 IDOR via unchecked category ID |
| CVE-2026-101084 | obot before v0.21.1 Authorization Bypass via /mcp-connect |
| CVE-2026-102107 | Kiteworks Core user impersonation in a file-request feature |
| CVE-2026-10212 | AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization |
| CVE-2026-102139 | Kiteworks Email Protection Gateway Incorrect Authorization |
| CVE-2026-102157 | Security Advisory 0190 |
| CVE-2026-102261 | owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization |
| CVE-2026-102298 | Insufficient Authorization and User Boundary Validation in Omada Controller MSP |
| CVE-2026-102373 | GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter |
| CVE-2026-102382 | WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-102406 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception |
| CVE-2026-103233 | AdithyaYelloju Restaurant-Management-System Admin Area admin authorization |
| CVE-2026-103235 | MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events |
| CVE-2026-103237 | MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows |
| CVE-2026-103246 | n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection |
| CVE-2026-103247 | n8n before 1.123.80 Credential Tampering via Duplicate Node IDs |
| CVE-2026-103252 | n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint |
| CVE-2026-103288 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like |
| CVE-2026-103366 | Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vi... |
| CVE-2026-103988 | FileRise renameFolder omits destination-parent authorization |
| CVE-2026-104049 | Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint |
| CVE-2026-104050 | Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers |
| CVE-2026-104118 | Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR |
| CVE-2026-104651 | Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR |
| CVE-2026-104684 | Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode |
| CVE-2026-104875 | Ente: Accepted emergency contact can bypass the recovery notice period |
| CVE-2026-104894 | Plane: Cross-Tenant Module Issue Linking via IDOR |
| CVE-2026-104898 | Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Pr... |
| CVE-2026-104960 | Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project wor... |
| CVE-2026-104964 | Plane: Cross-Workspace Project Modification via Unscoped Project Lookup |
| CVE-2026-104965 | Plane: Cross-Tenant Issue Relation Creation via IDOR |
| CVE-2026-104966 | Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces |
| CVE-2026-104967 | Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and S... |
| CVE-2026-104969 | Plane: Cross-Tenant Cycle Issue Hijack via IDOR |
| CVE-2026-104971 | Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization |
| CVE-2026-104975 | Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints |
| CVE-2026-105029 | UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint |
| CVE-2026-105040 | EnergizeLab Eilik User-ID Mass Assignment Account Takeover |
| CVE-2026-105096 | Omega Solution CoinEx Crypto Customer Profile API customer authorization |
| CVE-2026-105097 | Omega Solution CoinEx Crypto Customer Information API customer-currency authorization |
| CVE-2026-105411 | Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 |
| CVE-2026-10542 | Playbooks channel action update validation issue |
| CVE-2026-105572 | PickMall Lilishop Buyer Invoice List receipt authorization |
| CVE-2026-105629 | Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup |
| CVE-2026-105631 | Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & un... |
| CVE-2026-105633 | Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope |
| CVE-2026-105637 | Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558) |
| CVE-2026-105639 | Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane |
| CVE-2026-107637 | pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action |
| CVE-2026-107652 | Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission... |
| CVE-2026-107702 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking |
| CVE-2026-107762 | Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via... |
| CVE-2026-107789 | SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR |
| CVE-2025-7733 | WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference |
| CVE-2025-8057 | IDOR in Patika Global Technologies' HumanSuite |
| CVE-2025-8447 | Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access |
| CVE-2025-8463 | IDOR in SecHard Information Technologies' SecHard |
| CVE-2025-8855 | 2FA Expiry Bypass in Optimus Software's Brokerage Automation |
| CVE-2025-8884 | IDOR in VHS Electronic Software's ACE Center |
| CVE-2025-8887 | IDOR in Usta Information Systems' Aybs Interaktif |
| CVE-2025-9520 | IDOR Leading to Owner Account Hijacking in Omada Controller |
| CVE-2025-9559 | Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface... |
| CVE-2026-100177 | Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment |
| CVE-2026-10023 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (... |
| CVE-2026-10038 | Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'a... |
| CVE-2026-10041 | WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Dat... |
| CVE-2026-100514 | WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-100517 | WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-100531 | openclaw Slack before 2026.8.1 Authorization Bypass |
| CVE-2026-100534 | OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass |
| CVE-2026-102775 | Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1... |
| CVE-2026-103009 | Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure |
| CVE-2026-103054 | AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP |
| CVE-2026-103078 | WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-103079 | WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-103083 | WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object Referenc... |
| CVE-2026-105257 | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR |
| CVE-2026-105268 | Gitea issue attachment API allows changing comment attachments |
| CVE-2026-105272 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of... |
| CVE-2026-105692 | Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create |
| CVE-2026-105698 | Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints |
| CVE-2026-105699 | Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers |
| CVE-2026-105754 | vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features |
| CVE-2026-105755 | vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity b... |
| CVE-2026-105761 | Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers |
| CVE-2026-106100 | Payload: Field-level write access bypass in Payload on MongoDB |
| CVE-2026-106166 | NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter |
| CVE-2026-10623 | PressPrimer Quiz <= 2.3.0 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id',... |
| CVE-2026-10630 | WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via '... |
| CVE-2026-10631 | Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier |
| CVE-2026-107193 | Foreman: api filter lookup ignores a search-limited filter permission |
| CVE-2026-107270 | Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints |
| CVE-2026-107416 | WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-107427 | WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-107444 | Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass |
| CVE-2026-107445 | Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass |
| CVE-2026-108066 | WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR |
| CVE-2026-108092 | Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Inf... |
| CVE-2026-108096 | Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category |
| CVE-2026-108110 | MOVO through 0.2.3 Authorization Bypass via Document Endpoints |
| CVE-2026-108126 | temporal-proxy payload decryption is not bound to the request namespace |
| CVE-2026-108164 | Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route |
| CVE-2026-10820 | ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR |
| CVE-2026-108796 | ZKTeco BioTime Biometric Data Endpoint finger_data authorization |
| CVE-2026-108797 | ZKTeco BioTime Employee REST API employees authorization |
| CVE-2026-108853 | UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app |
| CVE-2026-108854 | Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key |
| CVE-2026-108856 | UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting |
| CVE-2026-108862 | APIPark through 1.9.7-beta IDOR via application authorization endpoints |
| CVE-2026-108864 | iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint |
| CVE-2026-108879 | JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter |
| CVE-2026-108924 | getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization |
| CVE-2026-109116 | AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization |
| CVE-2026-109164 | TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey... |
| CVE-2026-109165 | TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create |
| CVE-2026-109166 | lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById |
| CVE-2026-109167 | TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save |
| CVE-2026-109168 | lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId |
| CVE-2026-109175 | MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList |
| CVE-2026-109176 | MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files |
| CVE-2026-109177 | MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit |
| CVE-2026-109180 | jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs |
| CVE-2026-109194 | Quay: build trigger uuid idor in quay api |
| CVE-2026-109195 | Quay: repository auto-prune policy uuid idor in quay api |
| CVE-2026-111596 | Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR |
| CVE-2026-111603 | PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints |
| CVE-2026-111604 | eladmin through 2.7 Broken Access Control via /api/users Update and Delete |
| CVE-2026-111605 | Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController |
| CVE-2026-100142 | FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR |
| CVE-2026-100878 | zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization |
| CVE-2026-100885 | Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization |
| CVE-2026-100897 | fuzui StudentInfo Password Change Endpoint moditypasswordstu authorization |
| CVE-2026-10096 | Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' P... |
| CVE-2026-101112 | Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 |
| CVE-2026-10140 | Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem |
| CVE-2026-10154 | Dolibarr ERP CRM messaging.php authorization |
| CVE-2026-102663 | OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search |
| CVE-2026-102844 | gedelumbung HospitalManagement laporan_data_pasien.php detail authorization |
| CVE-2026-102876 | SurrealDB before 3.3.0 Cross-Tenant Access via Headers |
| CVE-2026-102980 | Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope |
| CVE-2026-102981 | Plane: Unauthenticated Workspace Invitation Token Leakage |
| CVE-2026-102986 | Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}... |
| CVE-2026-103446 | WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments |
| CVE-2026-103476 | yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download |
| CVE-2026-103525 | FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclo... |
| CVE-2026-104403 | WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-104444 | YesWiki before 4.6.7 Authorization Bypass via Comments API editComment |
| CVE-2026-104449 | YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche |
| CVE-2026-104645 | Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Upda... |
| CVE-2026-105171 | kishor-23 food-waste-management-system Role Attribute admin.php authorization |
| CVE-2026-105196 | LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API |
| CVE-2026-105197 | LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR |
| CVE-2026-105198 | LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR |
| CVE-2026-105811 | Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS |
| CVE-2026-105836 | QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms |
| CVE-2026-105847 | Payload: Polymorphic join queries could disclose hidden fields |
| CVE-2026-105859 | Payload: Unauthorized update to collection documents |
| CVE-2026-105867 | Payload: Client uploads could overwrite S3 objects |
| CVE-2026-105893 | WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability |
| CVE-2026-10597 | ITPison｜OMICARD EDM - Insecure Direct Object Reference |
| CVE-2026-105977 | Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail |
| CVE-2026-10599 | Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse |
| CVE-2026-106603 | WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-10700 | Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files |
| CVE-2026-107319 | GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure |
| CVE-2026-107366 | Langflow OSS Authorization Bypass Through User-Controlled Key |
| CVE-2026-10780 | Static Block <= 2.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via S... |
| CVE-2026-107850 | Contao: Improper access control in the preview links module |
| CVE-2026-107854 | Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check) |
| CVE-2026-107856 | CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email |
| CVE-2026-107868 | WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability |
| CVE-2026-1080 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-108547 | AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var |
| CVE-2026-108574 | BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization |
| CVE-2026-108596 | OpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Header |
| CVE-2026-108607 | JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter |
| CVE-2026-108608 | JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter |
| CVE-2026-108609 | JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter |
| CVE-2026-109287 | Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID |
| CVE-2026-109296 | Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes |
| CVE-2026-109303 | Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query |
| CVE-2026-109329 | Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php |
| CVE-2026-109334 | SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use |
| CVE-2026-109343 | SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement |
| CVE-2026-110070 | Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR |
| CVE-2026-110098 | Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests |
| CVE-2026-110106 | RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId} |
| CVE-2026-110107 | RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId} |
| CVE-2026-110113 | PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint |
| CVE-2026-110118 | WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints |
| CVE-2026-110119 | yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController |
| CVE-2026-110120 | yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController |
| CVE-2026-110121 | PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint |
| CVE-2026-110122 | PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint |
| CVE-2026-110124 | FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints |
| CVE-2026-110125 | waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints |
| CVE-2026-110126 | waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints |
| CVE-2026-110127 | waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints |
| CVE-2026-110129 | fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail |
| CVE-2026-110213 | ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints |
| CVE-2026-110226 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation |
| CVE-2026-110238 | Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component |
| CVE-2026-111902 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API |
| CVE-2026-111905 | phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data |
| CVE-2026-111908 | phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API |
| CVE-2026-111912 | Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update |
| CVE-2026-111939 | Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation |
| CVE-2026-111947 | Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication |
| CVE-2026-111961 | Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page |
| CVE-2026-111972 | Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR |
| CVE-2026-112004 | Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint |
| CVE-2026-112043 | calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization |
| CVE-2026-112068 | Insecure Direct Object Reference in extension "Analytics" (analytics) |
| CVE-2026-112240 | Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) |
| CVE-2026-112286 | Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints |
| CVE-2026-112287 | Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module |
| CVE-2026-112294 | FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint |
| CVE-2026-11369 | IDOR in Comment API Allows Cross-Process Comment Read and Write |
| CVE-2026-113727 | OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs |
| CVE-2026-11399 | Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arb... |
| CVE-2026-114066 | Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints |
| CVE-2026-114068 | Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint |
| CVE-2026-114077 | Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 |
| CVE-2026-114078 | Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup |
| CVE-2026-114079 | Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint |
| CVE-2026-114091 | Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route |
| CVE-2026-114389 | Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade |
| CVE-2026-114392 | Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid |
| CVE-2026-114393 | Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints |
| CVE-2026-114394 | Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs |
| CVE-2026-114395 | Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send |
| CVE-2026-11454 | Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference |
| CVE-2026-11461 | NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization |
| CVE-2026-114698 | WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-114741 | WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR |
| CVE-2026-114742 | WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR |
| CVE-2026-11500 | Weaviate Static API Key client.go validateConfig authorization |
| CVE-2026-115259 | Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR |
| CVE-2026-115321 | Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment |
| CVE-2026-115322 | Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers |
| CVE-2026-115325 | Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup |
| CVE-2026-115326 | QloApps through 1.7.0 IDOR via OrderDetailController Refund Request |
| CVE-2026-115329 | Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet |
| CVE-2026-115334 | Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint |
| CVE-2026-115453 | Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries |
| CVE-2026-115706 | Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation |
| CVE-2026-115725 | Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id |
| CVE-2026-115748 | Apache Vysper: Authorization bypass |
| CVE-2026-11578 | Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR |
| CVE-2026-11580 | Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR |
| CVE-2026-115803 | Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization |
| CVE-2026-115804 | Consul vulnerable to an authorization bypass in health check registration |
| CVE-2026-115994 | BOLA Allows Cross-Project Target Tampering |
| CVE-2026-115998 | IDOR: User reads and modifies findings from other people's projects |
| CVE-2026-116010 | RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers |
| CVE-2026-116015 | yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint |
| CVE-2026-116017 | Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint |
| CVE-2026-116018 | ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint |
| CVE-2026-116068 | Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router |
| CVE-2026-116183 | phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID |
| CVE-2026-116184 | OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket |
| CVE-2026-116185 | OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos |
| CVE-2026-107793 | Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete |
| CVE-2026-108641 | JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne |
| CVE-2026-108642 | JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit |
| CVE-2026-108672 | JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser |
| CVE-2026-108689 | Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send |
| CVE-2026-108696 | CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship |
| CVE-2026-108704 | CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints |
| CVE-2026-108715 | LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php |
| CVE-2026-108724 | Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint |
| CVE-2026-108747 | Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion |
| CVE-2026-108758 | Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint |
| CVE-2026-108763 | Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR |
| CVE-2026-109393 | QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers |
| CVE-2026-109394 | Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout |
| CVE-2026-109427 | Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs |
| CVE-2026-109431 | Camunda Missing Authorization in Task Sub-Resources |
| CVE-2026-109568 | Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes |
| CVE-2026-109675 | Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs |
| CVE-2026-109848 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a u... |
| CVE-2026-109957 | EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter |
| CVE-2026-109963 | Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php |
| CVE-2026-110381 | WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-110383 | WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerabili... |
| CVE-2026-110465 | WisdomGarden｜Tronclass - Insecure Direct Object Reference |
| CVE-2026-110467 | WisdomGarden｜Tronclass - Insecure Direct Object Reference |
| CVE-2026-110494 | Gitea release attachment re-linking of issue attachments |
| CVE-2026-110514 | WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR |
| CVE-2026-110608 | BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive |
| CVE-2026-110611 | REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid |
| CVE-2026-110613 | youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List |
| CVE-2026-110620 | Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId |
| CVE-2026-110724 | In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bu... |
| CVE-2026-110763 | lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany |
| CVE-2026-110764 | AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download |
| CVE-2026-110771 | Shopizer through 3.2.5 Authorization Bypass via Product Review customerId |
| CVE-2026-110774 | Blinko through 1.8.8 Private Attachment Read via /api/file Route |
| CVE-2026-110775 | Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access |
| CVE-2026-110841 | n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval |
| CVE-2026-110851 | n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint |
| CVE-2026-110853 | n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON |
| CVE-2026-110901 | WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-110902 | WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-111169 | La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation |
| CVE-2026-111324 | rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo |
| CVE-2026-111331 | Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router |
| CVE-2026-111344 | APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description |
| CVE-2026-111345 | Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id |
| CVE-2026-111346 | ZenTao PMS through 22.6 Authorization Bypass via action::editComment |
| CVE-2026-111348 | Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints |
| CVE-2026-111351 | metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API |
| CVE-2026-111354 | crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints |
| CVE-2026-111355 | zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints |
| CVE-2026-111358 | SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form |
| CVE-2026-111359 | CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift |
| CVE-2026-111363 | BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox |
| CVE-2026-111364 | MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch |
| CVE-2026-111365 | cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints |
| CVE-2026-111366 | cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints |
| CVE-2026-111368 | ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes |
| CVE-2026-111417 | Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service |
| CVE-2026-118668 | LangGraph JavaScript custom authentication may permit cross-user Store access |
| CVE-2026-11875 | WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery |
| CVE-2026-118760 | Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads |
| CVE-2026-11880 | Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR |
| CVE-2026-11889 | SALTO ProAccess Space Authorization Bypass Through User-Controlled Key |
| CVE-2026-118947 | Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor |
| CVE-2026-11896 | My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Param... |
| CVE-2026-11900 | Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure vi... |
| CVE-2026-119038 | Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leak... |
| CVE-2026-119048 | JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module |
| CVE-2026-119049 | FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming |
| CVE-2026-11987 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object... |
| CVE-2026-11988 | LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via... |
| CVE-2026-120007 | NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid |
| CVE-2026-1201 | Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs |
| CVE-2026-120199 | LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API |
| CVE-2026-120200 | Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes |
| CVE-2026-120263 | Gitea OAuth2 account auto-linking takeover through the sign-up form |
| CVE-2026-120319 | Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization |
| CVE-2026-1206 | Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure... |
| CVE-2026-12073 | ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite |
| CVE-2026-12102 | UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_... |
| CVE-2026-1213 | Askbot 0.12.2 - Insecure Direct Object Reference (IDOR) |
| CVE-2026-1219 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Referen... |
| CVE-2026-12204 | ShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorization |
| CVE-2026-12271 | Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR |
| CVE-2026-12274 | Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR |
| CVE-2026-1228 | Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode... |
| CVE-2026-12376 | Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint |
| CVE-2026-12384 | Broken Access Control in TECHIN2B Application |
| CVE-2026-12393 | WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR |
| CVE-2026-12397 | WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDOR |
| CVE-2026-12400 | FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST AP... |
| CVE-2026-12411 | Broken Access Control in Canonical LXD DevLXD API |
| CVE-2026-12418 | User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direc... |
| CVE-2026-12433 | Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'book... |
| CVE-2026-12904 | Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/... |
| CVE-2026-12905 | Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference t... |
| CVE-2026-12906 | RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure |
| CVE-2026-1291 | Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation |
| CVE-2026-12945 | Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints |
| CVE-2026-12995 | Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deleti... |
| CVE-2026-12998 | Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draf... |
| CVE-2026-13116 | PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sen... |
| CVE-2026-13145 | WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR |
| CVE-2026-13146 | WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR |
| CVE-2026-13404 | Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init |
| CVE-2026-13445 | Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple una... |
| CVE-2026-13450 | GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parame... |
| CVE-2026-13464 | Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Paramete... |
| CVE-2026-13471 | LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Book... |
| CVE-2026-13490 | glpi-project glpi Document document.send.php canViewFile authorization |
| CVE-2026-13512 | Databend Tenant client_session_manager.rs state_key authorization |
| CVE-2026-13534 | CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization |
| CVE-2026-13549 | CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization |
| CVE-2026-13612 | KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR |
| CVE-2026-1375 | Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deleti... |
| CVE-2026-1389 | Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Del... |
| CVE-2026-14165 | Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 |
| CVE-2026-14183 | Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR |
| CVE-2026-14184 | Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR |
| CVE-2026-14187 | Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR |
| CVE-2026-14195 | Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info |
| CVE-2026-14196 | WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR |
| CVE-2026-14197 | Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR |
| CVE-2026-14209 | Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions |
| CVE-2026-14211 | Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR |
| CVE-2026-14212 | Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR |
| CVE-2026-14213 | Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR |
| CVE-2026-14223 | Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR |
| CVE-2026-14224 | Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR |
| CVE-2026-14306 | Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass |
| CVE-2026-111607 | Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs |
| CVE-2026-111608 | Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId} |
| CVE-2026-111609 | PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription |
| CVE-2026-111610 | B3log Solo through 4.4.0 Missing Authorization in ArticleConsole |
| CVE-2026-111611 | roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints |
| CVE-2026-111614 | DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials |
| CVE-2026-111615 | Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint |
| CVE-2026-111616 | Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API |
| CVE-2026-111620 | O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint |
| CVE-2026-111621 | TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key} |
| CVE-2026-111629 | IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs |
| CVE-2026-111630 | abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations |
| CVE-2026-111632 | Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id |
| CVE-2026-111640 | DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs |
| CVE-2026-111645 | MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint |
| CVE-2026-111647 | PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id} |
| CVE-2026-111648 | BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter |
| CVE-2026-111649 | Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint |
| CVE-2026-111651 | Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController |
| CVE-2026-111654 | FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints |
| CVE-2026-111655 | ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit |
| CVE-2026-111656 | ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints |
| CVE-2026-111657 | BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint |
| CVE-2026-111658 | SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API |
| CVE-2026-111667 | REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint |
| CVE-2026-111671 | Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints |
| CVE-2026-111672 | Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints |
| CVE-2026-111674 | Tbed through 20240319 Missing Authorization via setImgFileName Endpoint |
| CVE-2026-111676 | Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint |
| CVE-2026-111680 | APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter |
| CVE-2026-111684 | Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service |
| CVE-2026-111689 | XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint |
| CVE-2026-111695 | Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API |
| CVE-2026-111697 | HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs |
| CVE-2026-111698 | HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge |
| CVE-2026-111702 | ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases |
| CVE-2026-111703 | yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints |
| CVE-2026-111705 | Fuint through commit 57ec018 IDOR via bookId in myBookDetail |
| CVE-2026-111707 | 99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure |
| CVE-2026-111709 | WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId |
| CVE-2026-111715 | Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API |
| CVE-2026-111716 | Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes |
| CVE-2026-111717 | Arkon through 0.9.2 Missing Authorization via Skills Versions API |
| CVE-2026-111721 | Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping |
| CVE-2026-111722 | LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API |
| CVE-2026-111767 | MCP TypeScript SDK: Experimental tasks were not tied to the session that created them |
| CVE-2026-112861 | WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-112868 | WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-113349 | OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent |
| CVE-2026-113353 | LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers |
| CVE-2026-113359 | Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint |
| CVE-2026-113489 | GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR |
| CVE-2026-113596 | Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds |
| CVE-2026-113597 | Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures |
| CVE-2026-113598 | Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete |
| CVE-2026-113599 | Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation |
| CVE-2026-113600 | Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy |
| CVE-2026-113603 | x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource |
| CVE-2026-113606 | Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders |
| CVE-2026-113610 | Xen Orchestra before 6.9.0 Authorization Bypass via user.set API |
| CVE-2026-113643 | EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization |
| CVE-2026-113655 | ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create... |
| CVE-2026-113665 | ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints |
| CVE-2026-16264 | Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR |
| CVE-2026-16281 | Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR |
| CVE-2026-16291 | ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR |
| CVE-2026-16307 | IDOR in Netiket Information Technologies' EdoWEB |
| CVE-2026-16309 | IDOR in Netiket Information Technologies' EdoWEB |
| CVE-2026-16310 | MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter |
| CVE-2026-16450 | zsadmin2025 ZS-Admin MyBatis-Plus Tenant Plugin page getTenantId authorization |
| CVE-2026-116186 | OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId |
| CVE-2026-116187 | Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads |
| CVE-2026-116239 | pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username |
| CVE-2026-116340 | iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorizati... |
| CVE-2026-116672 | Authlib RFC 7592 examples omit registration-access-token client binding |
| CVE-2026-116745 | QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation |
| CVE-2026-116746 | QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview |
| CVE-2026-116810 | OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences |
| CVE-2026-116898 | REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move |
| CVE-2026-116899 | REDAXO before 5.21.4 Broken Access Control in Slice Operations |
| CVE-2026-117562 | rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint |
| CVE-2026-117563 | MrDoc through 1.1.1 Broken Access Control via manage_doc_share |
| CVE-2026-117574 | Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path wit... |
| CVE-2026-117605 | nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers |
| CVE-2026-117606 | NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions |
| CVE-2026-11763 | IDOR in GIS Informatics' GisLab Laboratory Management System |
| CVE-2026-118084 | WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-119325 | Bricks Theme Broken Access Control via load_popup_content |
| CVE-2026-119329 | Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers |
| CVE-2026-119421 | Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation |
| CVE-2026-119547 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id} |
| CVE-2026-119548 | Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook |
| CVE-2026-119555 | Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback |
| CVE-2026-119571 | Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID |
| CVE-2026-119596 | UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download |
| CVE-2026-119598 | Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id |
| CVE-2026-11963 | User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR |
| CVE-2026-119644 | Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints |
| CVE-2026-119645 | ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc |
| CVE-2026-119646 | Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API |
| CVE-2026-119647 | RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId} |
| CVE-2026-119650 | HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController |
| CVE-2026-119651 | HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion |
| CVE-2026-119652 | HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure |
| CVE-2026-119657 | FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations |
| CVE-2026-119658 | PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update |
| CVE-2026-119659 | Blossom through 1.17.1 Authorization Bypass via Folder Endpoints |
| CVE-2026-11966 | User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler |
| CVE-2026-119661 | ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries |
| CVE-2026-119663 | Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create |
| CVE-2026-119664 | Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update |
| CVE-2026-119708 | abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name |
| CVE-2026-1251 | SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Refere... |
| CVE-2026-12510 | AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR |
| CVE-2026-12657 | LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter |
| CVE-2026-12686 | Incorrect authorisation in Adiss’s Biloop |
| CVE-2026-12693 | IDOR in Vimesoft's Enterprise Video Platform |
| CVE-2026-12697 | wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR |
| CVE-2026-1271 | ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Ima... |
| CVE-2026-13169 | Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR |
| CVE-2026-13175 | Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR |
| CVE-2026-13177 | Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR |
| CVE-2026-13178 | Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation |
| CVE-2026-13319 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-13345 | Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Tab... |
| CVE-2026-13350 | Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be all... |
| CVE-2026-13358 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecu... |
| CVE-2026-1338 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-13381 | VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion |
| CVE-2026-13399 | Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order |
| CVE-2026-19416 | KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR |
| CVE-2026-19417 | KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR |
| CVE-2026-19734 | IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking |
| CVE-2026-19784 | francoisjacquet RosarioSIS Referrals.php DBUpdate authorization |
| CVE-2026-19834 | Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization |
| CVE-2026-19836 | Webkul Bagisto Backend Customer Detail Feature view authorization |
| CVE-2026-19838 | Webkul Bagisto Backend Reporting Endpoint sales authorization |
| CVE-2026-14310 | Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection |
| CVE-2026-14313 | PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR |
| CVE-2026-14314 | PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR |
| CVE-2026-14326 | Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR |
| CVE-2026-1436 | Improper Access Control (IDOR) vulnerability in Graylog Web Interface |
| CVE-2026-14566 | Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering |
| CVE-2026-14608 | SourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view_student authorization |
| CVE-2026-14614 | Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource |
| CVE-2026-14753 | mjperpinosa stumasy Note Handler/Assignment notes authorization |
| CVE-2026-14793 | Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization |
| CVE-2026-14823 | Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR |
| CVE-2026-14825 | Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR |
| CVE-2026-14826 | Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR |
| CVE-2026-14832 | ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone |
| CVE-2026-14842 | Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass |
| CVE-2026-14843 | Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR |
| CVE-2026-14847 | Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR |
| CVE-2026-14857 | WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR |
| CVE-2026-14858 | WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR |
| CVE-2026-14861 | User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR |
| CVE-2026-14927 | FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes |
| CVE-2026-14938 | FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR |
| CVE-2026-1496 | Coverity CLI Authentication Bypass |
| CVE-2026-15036 | Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization |
| CVE-2026-15058 | Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenti... |
| CVE-2026-15147 | Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR |
| CVE-2026-15159 | Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosu... |
| CVE-2026-15191 | mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization |
| CVE-2026-15209 | JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR |
| CVE-2026-15214 | Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR |
| CVE-2026-15219 | IDOR in SFM Software's Costifier |
| CVE-2026-15231 | TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR |
| CVE-2026-15232 | Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion |
| CVE-2026-15238 | Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR |
| CVE-2026-15255 | RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR |
| CVE-2026-15257 | RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification |
| CVE-2026-15260 | Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR |
| CVE-2026-15389 | Inadequate access control in Sesame Time session management |
| CVE-2026-1541 | Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Refe... |
| CVE-2026-15468 | Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.... |
| CVE-2026-15516 | MacCMS Pro Installation Index.php step5 authorization |
| CVE-2026-1558 | WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'rec... |
| CVE-2026-15622 | poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization |
| CVE-2026-15637 | Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 all... |
| CVE-2026-15909 | RafyMrX TOKO-ONLINE-ROTI add.php authorization |
| CVE-2026-15945 | Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 |
| CVE-2026-16039 | MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR |
| CVE-2026-16058 | YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration |
| CVE-2026-16070 | Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR |
| CVE-2026-16075 | AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization |
| CVE-2026-16105 | Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints |
| CVE-2026-16142 | TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parame... |
| CVE-2026-1619 | IDOR in Universal Sotware's FlexCity/Kiosk |
| CVE-2026-16214 | geex-arts django-jet Dashboard views.py authorization |
| CVE-2026-16217 | guohongze adminset Delivery Deployment Endpoint deli.py authorization |
| CVE-2026-16797 | ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'op... |
| CVE-2026-16953 | AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie |
| CVE-2026-16957 | Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure |
| CVE-2026-16979 | SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration |
| CVE-2026-16981 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR |
| CVE-2026-17018 | CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR |
| CVE-2026-17020 | Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure |
| CVE-2026-1704 | Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information E... |
| CVE-2026-17059 | Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter |
| CVE-2026-17349 | pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner |
| CVE-2026-17527 | Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/sour... |
| CVE-2026-1753 | Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update |
| CVE-2026-17531 | unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization |
| CVE-2026-17538 | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure... |
| CVE-2026-17562 | IDOR in Zirve Security's AdisyonPro |
| CVE-2026-17567 | Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transact... |
| CVE-2026-17570 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged us... |
| CVE-2026-17627 | Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint |
| CVE-2026-2270 | StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation |
| CVE-2026-2346 | IDOR in Menulux Software's Mobile App |
| CVE-2026-2347 | IDOR in Akıllı Ticaret's E-Commerce Pack |
| CVE-2026-23478 | Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback |
| CVE-2026-23487 | Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token |
| CVE-2026-23488 | Blinko: multiple interfaces in the comment feature allow unauthorized access |
| CVE-2026-23522 | Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion |
| CVE-2026-23638 | Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-2366 | Keycloak: keycloak: information disclosure via authorization bypass in admin api |
| CVE-2026-23754 | D-Link D-View 8 IDOR Allows Credential Disclosure and Account Takeover |
| CVE-2026-23843 | teklifolustur_app's IDOR vulnerability allows unauthorized access to other users' offers |
| CVE-2026-2406 | IDOR in Universe Software's Online Registration and Workflow Management System |
| CVE-2026-24134 | StudioCMS has an Authorization Bypass Through User-Controlled Key |
| CVE-2026-24136 | Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API |
| CVE-2026-2414 | Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects... |
| CVE-2026-24379 | WordPress WP Job Portal plugin <= 2.4.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24631 | WordPress Rosebud theme <= 1.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24634 | WordPress Ultimate Reviews plugin <= 3.2.16 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24753 | Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-24755 | Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-24756 | Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-24761 | Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-24773 | Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Files |
| CVE-2026-24776 | OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer |
| CVE-2026-25654 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user a... |
| CVE-2026-25744 | OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals |
| CVE-2026-25745 | OpenEMR's Message Update Ignores Patient id |
| CVE-2026-16564 | Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint |
| CVE-2026-16565 | Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API |
| CVE-2026-16567 | Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle |
| CVE-2026-16568 | ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR |
| CVE-2026-16574 | Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint |
| CVE-2026-1664 | Insecure Direct Object Reference (IDOR) via Header-Based Email Routing |
| CVE-2026-16737 | WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart |
| CVE-2026-16746 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint |
| CVE-2026-18028 | Missing authorization check in event quick setup view |
| CVE-2026-18121 | Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/... |
| CVE-2026-18200 | FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update |
| CVE-2026-18258 | Authorization Bypass Through User-Controlled Key in eScriptorium |
| CVE-2026-18275 | Authorization Bypass Through User-Controlled Key in eScriptorium |
| CVE-2026-18315 | TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_... |
| CVE-2026-18423 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset... |
| CVE-2026-18439 | Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification... |
| CVE-2026-18441 | LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Informa... |
| CVE-2026-18620 | Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy |
| CVE-2026-18631 | jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization |
| CVE-2026-18722 | diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization |
| CVE-2026-1881 | Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta |
| CVE-2026-18818 | Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization |
| CVE-2026-1883 | Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion |
| CVE-2026-18904 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulner... |
| CVE-2026-18945 | WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation |
| CVE-2026-18962 | WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization |
| CVE-2026-19064 | SourceCodester Online Examination & Learning Management System view.php authorization |
| CVE-2026-19066 | SourceCodester Online Examination & Learning Management System view_students.php authorization |
| CVE-2026-19077 | Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization |
| CVE-2026-19083 | IDOR in AKIN Software's OctoCloud |
| CVE-2026-19085 | Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure |
| CVE-2026-19111 | Insecure direct object reference in Strands Agents Tools memory tool namespace isolation |
| CVE-2026-19130 | Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlle... |
| CVE-2026-19228 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-19294 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulner... |
| CVE-2026-19424 | Inventec Appliances｜Chiline Cloud - Insecure Direct Object Reference |
| CVE-2026-19433 | Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export |
| CVE-2026-1947 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modi... |
| CVE-2026-19579 | Snipe-IT Checkout Request Cancellation IDOR |
| CVE-2026-19651 | IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities |
| CVE-2026-20219 | A vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote attacker to access the social prof... |
| CVE-2026-2028 | Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter |
| CVE-2026-20342 | Cisco Secure Firewall Management Center Software Low Privileged Arbitrary File Download Vulnerability |
| CVE-2026-20897 | Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) |
| CVE-2026-20904 | Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes |
| CVE-2026-20912 | Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure |
| CVE-2026-2104 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-21447 | Bagisto has IDOR in Customer Order Reorder Functionality |
| CVE-2026-22104 | Improper access control in Hashtopolis server chunk activity component |
| CVE-2026-22383 | WordPress PawFriends - Pet Shop and Veterinary WordPress theme theme <= 1.3 - Insecure Direct Object References (IDOR) vulner... |
| CVE-2026-22391 | WordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22393 | WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22396 | WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22398 | WordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22400 | WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22404 | WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22406 | WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-19869 | Privilege Escalation via Dropped Field-Level @authentication |
| CVE-2026-1987 | Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification |
| CVE-2026-19870 | IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation |
| CVE-2026-1989 | IDOR in PAVO Inc.'s PAVO Pay |
| CVE-2026-1992 | ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation |
| CVE-2026-19966 | CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization |
| CVE-2026-19979 | GL.iNet XE3000 WebDAV Service MOVE authorization |
| CVE-2026-19994 | Webkul Bagisto Configuration Management execute authorization |
| CVE-2026-19997 | Webkul Bagisto Backend Sales RMA Endpoint requests authorization |
| CVE-2026-21409 | Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted... |
| CVE-2026-22234 | OPEXUS eCasePortal unauthenticated IDOR |
| CVE-2026-22235 | OPEXUS eComplaint IDOR |
| CVE-2026-2230 | Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modifi... |
| CVE-2026-22489 | WordPress Image Slider Slideshow plugin <= 1.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-2257 | GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API |
| CVE-2026-22588 | Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification |
| CVE-2026-22589 | Spree API has Unauthenticated IDOR - Guest Address |
| CVE-2026-2398 | IDOR in AdamPOS' MobilMen 20T |
| CVE-2026-24178 | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated a... |
| CVE-2026-24599 | WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-2461 | Missing authorization check allows unauthorized modification of other users' comments on a board |
| CVE-2026-24900 | MarkUs has a submission-view IDOR exposes all student submissions |
| CVE-2026-24901 | Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts |
| CVE-2026-24950 | WordPress Authorsy plugin <= 1.0.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24991 | WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-25005 | WordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-25120 | Gogs Allows Cross-Repository Comment Deletion via DeleteComment |
| CVE-2026-25147 | OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid |
| CVE-2026-25197 | Gardyn Cloud API Authorization Bypass Through User-Controlled Key |
| CVE-2026-25220 | OpenEMR Messages "Show All" Not Restricted to Admins |
| CVE-2026-25324 | WordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-25497 | Craft has a GraphQL Asset Mutation Privilege Escalation |
| CVE-2026-25530 | Kanboard is missing authorization check in getSwimlane API allows cross-project data access |
| CVE-2026-2554 | WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendo... |
| CVE-2026-25563 | WeKan < 8.19 Checklist Creation Cross-Board IDOR |
| CVE-2026-25564 | WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation |
| CVE-2026-25567 | WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId |
| CVE-2026-25574 | Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) |
| CVE-2026-27705 | Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch |
| CVE-2026-27708 | FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access |
| CVE-2026-27793 | Seerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials |
| CVE-2026-27835 | wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data |
| CVE-2026-27838 | wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data |
| CVE-2026-27839 | wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup |
| CVE-2026-27881 | Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) |
| CVE-2026-27883 | Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure |
| CVE-2026-28302 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28305 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28308 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28313 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28314 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28316 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28317 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28354 | ClipBucket v5 has IDOR in Collection Item Management |
| CVE-2026-28361 | NocoDB: Missing Ownership Validation in MCP Token Operations |
| CVE-2026-28433 | Misskey lacks resource ownership validation |
| CVE-2026-29069 | Craft has an unauthenticated activation email trigger with potential user enumeration |
| CVE-2026-29071 | Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories |
| CVE-2026-2917 | Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via... |
| CVE-2026-25757 | Unauthenticated Spree Commerce users can view completed guest orders by Order ID |
| CVE-2026-25758 | Spree allows unauthenticated users can access all guest addresses |
| CVE-2026-25782 | Gitea tracked-time deletion can target entries from another issue |
| CVE-2026-25927 | OpenEMR Missing Authorization Checks in DICOM Viewer State API |
| CVE-2026-25929 | OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval |
| CVE-2026-25930 | OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms |
| CVE-2026-26004 | Sentry allows unauthorized access to event data across organizational boundaries |
| CVE-2026-26016 | Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization |
| CVE-2026-26078 | Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint |
| CVE-2026-2697 | Indirect Object Reference (IDOR) in Security Center |
| CVE-2026-2698 | Improper Access Control |
| CVE-2026-2729 | Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe Pay... |
| CVE-2026-27329 | WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-27397 | WordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-27432 | WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-27449 | Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints |
| CVE-2026-27591 | Winter: Privilege escalation by authenticated backend users |
| CVE-2026-27657 | Gitea email settings allow changing another user's primary email address |
| CVE-2026-27898 | Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher |
| CVE-2026-27943 | OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership |
| CVE-2026-27956 | Coolify: Cross-team application domain enumeration via domains_by_server endpoint |
| CVE-2026-28155 | WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-28180 | WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-28216 | hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment |
| CVE-2026-28225 | Manyfold has IDOR in ModelFilesController |
| CVE-2026-28444 | Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure |
| CVE-2026-28469 | OpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity |
| CVE-2026-28503 | Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404 |
| CVE-2026-28696 | Craft affected by IDOR via GraphQL @parseRefs |
| CVE-2026-28736 | Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) |
| CVE-2026-28740 | Gitea LFS object reuse bypasses Code-unit authorization |
| CVE-2026-28747 | Milesight Cameras Authorization Bypass Through User-Controlled Key |
| CVE-2026-28781 | Craft Affected by Entries Authorship Spoofing via Mass Assignment |
| CVE-2026-28782 | Craft has a Permission Bypass and IDOR in Duplicate Entry Action |
| CVE-2026-28788 | Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite |
| CVE-2026-2879 | GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion |
| CVE-2026-2888 | Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter |
| CVE-2026-29002 | CouchCMS Privilege Escalation via f_k_levels_list Parameter |
| CVE-2026-2918 | Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scr... |
| CVE-2026-29189 | SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints |
| CVE-2026-29200 | A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. T... |
| CVE-2026-29204 | Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another us... |
| CVE-2026-2997 | WisdomGarden｜Tronclass - Insecure Direct Object Reference |
| CVE-2026-3020 | Identity based authorization bypass vulnerability (IDOR) in the Wakyma application web |
| CVE-2026-30230 | Flare: Password‑Protected Thumbnail Bypass |
| CVE-2026-30231 | Flare: Private File IDOR via raw/direct endpoints |
| CVE-2026-30884 | mdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-30886 | New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check |
| CVE-2026-30920 | OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding |
| CVE-2026-30927 | Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter |
| CVE-2026-30944 | StudioCMS Affected by Privilege Escalation via Insecure API Token Generation |
| CVE-2026-30945 | StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service |
| CVE-2026-30954 | LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy() |
| CVE-2026-30959 | OneUptime has WhatsApp Resend Verification Authorization Bypass |
| CVE-2026-30969 | Coral Server has insufficient agent authentication in session communication channels |
| CVE-2026-3124 | Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'o... |
| CVE-2026-3139 | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object... |
| CVE-2026-3173 | Meta Field Block <= 1.5.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure |
| CVE-2026-31956 | Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization |
| CVE-2026-32300 | Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information |
| CVE-2026-3235 | WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Ref... |
| CVE-2026-32533 | WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-32535 | WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-32576 | WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-32589 | Mirror-registry: quay: insecure direct object reference in blobupload |
| CVE-2026-40043 | Pachno 1.0.6 Authentication Bypass via runSwitchUser() |
| CVE-2026-40127 | Authorization Bypass Through User-Controlled Key in OutSystems Lifetime |
| CVE-2026-40589 | FreeScout has Customer Edit Cross-Mailbox Email Takeover |
| CVE-2026-40590 | FreeScout's Customer AJAX Create Modifies Hidden Existing Customer |
| CVE-2026-40591 | FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification |
| CVE-2026-40600 | Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id |
| CVE-2026-40737 | WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40768 | WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-41372 | OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery |
| CVE-2026-41406 | OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages |
| CVE-2026-41471 | Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint |
| CVE-2026-4160 | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Ref... |
| CVE-2026-41878 | Insecure Direct Object Reference in R-SOFT DMS |
| CVE-2026-22407 | WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22409 | WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22411 | WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22426 | WordPress Sweet Jane theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22430 | WordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-3073 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-3074 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-30823 | Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration |
| CVE-2026-30825 | hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token |
| CVE-2026-30843 | Wekan has Cross-Board IDOR in Custom Fields Update Endpoints |
| CVE-2026-30857 | WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning |
| CVE-2026-31820 | Sylius affected by IDOR in Cart and Checkout LiveComponents |
| CVE-2026-31832 | Umbraco Backoffice API Allows Unauthorized Modification of Domain Data |
| CVE-2026-3185 | feiyuchuixue sz-boot-parent API Endpoint sys-message authorization |
| CVE-2026-31867 | Craft Commerce has a Potential IDOR in Commerce carts |
| CVE-2026-31869 | Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check |
| CVE-2026-31874 | Taskosaur Improper Role Assignment via Parameter Manipulation in User Registration |
| CVE-2026-32039 | OpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender |
| CVE-2026-32097 | PingPong has improper access control in thread file endpoints allows access outside intended scope |
| CVE-2026-32103 | StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation |
| CVE-2026-32104 | StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings |
| CVE-2026-32114 | Discourse's unscoped status lookups leak restricted metadata |
| CVE-2026-32120 | OpenEMR has IDOR in Fee Sheet Product Save |
| CVE-2026-32638 | StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens |
| CVE-2026-32694 | Insecure Direct Object Reference attack via predictable secret ID in Juju |
| CVE-2026-32697 | SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR) |
| CVE-2026-32761 | File Browser has an Authorization Policy Bypass in its Public Share Download Flow |
| CVE-2026-32867 | OPEXUS eComplaint unauthenticated file upload |
| CVE-2026-32894 | Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result |
| CVE-2026-32930 | Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check |
| CVE-2026-32976 | OpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands |
| CVE-2026-33030 | Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys |
| CVE-2026-33052 | MantisBT: Authorization Bypass in Global Profile Creation |
| CVE-2026-33053 | Langflow has Missing Ownership Verification in API Key Deletion (IDOR) |
| CVE-2026-3306 | Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write acc... |
| CVE-2026-3307 | Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of dele... |
| CVE-2026-33141 | Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data |
| CVE-2026-33158 | Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) |
| CVE-2026-33160 | Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL |
| CVE-2026-3321 | Authorization Bypass in ON24 Q&A chat |
| CVE-2026-33297 | AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php |
| CVE-2026-33304 | OpenEMR has Authorization Bypass in Dated Reminders Log |
| CVE-2026-33484 | Langflow has Unauthenticated IDOR on Image Downloads |
| CVE-2026-33511 | pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad |
| CVE-2026-33663 | n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition |
| CVE-2026-33678 | Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion |
| CVE-2026-33700 | Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion |
| CVE-2026-33702 | Chamilo LMS has an Insecure Direct Object Reference (IDOR) |
| CVE-2026-33703 | Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens |
| CVE-2026-3371 | Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification |
| CVE-2026-33724 | n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no |
| CVE-2026-33730 | Open Source Point of Sale has an IDOR in Password Change (Home) |
| CVE-2026-33735 | MyTube has an Improper Access Control that Allows Complete Application Takeover |
| CVE-2026-33736 | Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure |
| CVE-2026-33740 | EspoCRM: Email importEml can import and delete another user's attachment by raw fileId |
| CVE-2026-3473 | Improper file ownership validation in the Boards API allows unauthorised file access |
| CVE-2026-3482 | IBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization Bypass |
| CVE-2026-34832 | Scoold: Cross-Account Feedback Deletion (IDOR) |
| CVE-2026-35210 | OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection |
| CVE-2026-35430 | Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability |
| CVE-2026-35478 | InvenTree has Arbitrary API Token Creation |
| CVE-2026-35489 | Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` |
| CVE-2026-35584 | FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration |
| CVE-2026-3568 | MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update |
| CVE-2026-37978 | Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api |
| CVE-2026-37979 | Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass |
| CVE-2026-39331 | ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families |
| CVE-2026-39354 | Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask |
| CVE-2026-39374 | Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint |
| CVE-2026-39384 | FreeScout Customer Merge Cross-Mailbox Authorization Bypass |
| CVE-2026-39386 | Neko has Self-service Privilege Escalation for Authenticated Users |
| CVE-2026-39756 | WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39942 | Directus has a Path Traversal and Broken Access Control in File Management API |
| CVE-2026-39967 | TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter |
| CVE-2026-39968 | TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint |
| CVE-2026-3999 | Broken access control vulnerability affecting ID Server |
| CVE-2026-40480 | ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}` |
| CVE-2026-40570 | FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII |
| CVE-2026-44570 | Open WebUI: Inconsistent authorization controls within memories API |
| CVE-2026-44585 | Paymenter: Broken object level authorization via service reference manipulation on ticket creation |
| CVE-2026-44678 | Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID |
| CVE-2026-44692 | Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint |
| CVE-2026-44718 | Mathesar: Missing collaborator checks allowed access to saved explorations in other databases |
| CVE-2026-44986 | Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile |
| CVE-2026-4503 | Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint |
| CVE-2026-45295 | FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoi... |
| CVE-2026-45297 | Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch |
| CVE-2026-45330 | Decidim: Verification admins can access supplied IDs from other organisations |
| CVE-2026-45342 | LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes |
| CVE-2026-45349 | Open WebUI: Broken Access Control for Completions API |
| CVE-2026-45385 | Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint |
| CVE-2026-45386 | Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint |
| CVE-2026-45398 | Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls |
| CVE-2026-45402 | Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints |
| CVE-2026-45414 | Decidim: JWT-backed authentication can be replayed across organizations |
| CVE-2026-4563 | MacCMS Member Order Detail User.php order_info authorization |
| CVE-2026-45666 | Open WebUI: Indirect Object Reference (IDOR) in user notes |
| CVE-2026-45671 | Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion |
| CVE-2026-45760 | Apache Camel K: Camel K Cross-Namespace Build Deputy Attack |
| CVE-2026-45810 | Nextcloud: Propfind requests for file comments allowed to load comments for other files |
| CVE-2026-45830 | A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users t... |
| CVE-2026-45832 | All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization lay... |
| CVE-2026-4630 | Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference |
| CVE-2026-46390 | HAX CMS has Unauthenticated Git Access via User-Controlled Key |
| CVE-2026-46407 | Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens |
| CVE-2026-46408 | Vvveb: checkout IDOR allows unauthorized reuse of another user's cart |
| CVE-2026-46414 | Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking |
| CVE-2026-46438 | wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry |
| CVE-2026-46441 | Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment |
| CVE-2026-46453 | Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header... |
| CVE-2026-47378 | NocoDB: Hidden Column Exposure in Public Shared View Endpoints |
| CVE-2026-47388 | NocoDB: Missing Ownership Check in MCP Attachment Read |
| CVE-2026-47399 | PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID |
| CVE-2026-47406 | praisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace ownership check, cross-workspace is... |
| CVE-2026-47407 | PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation |
| CVE-2026-47408 | praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership |
| CVE-2026-47414 | praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace l... |
| CVE-2026-48016 | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment |
| CVE-2026-48052 | Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request |
| CVE-2026-48067 | Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields |
| CVE-2026-48073 | Docmost: Page export can include restricted same-space attachments through forged attachmentId |
| CVE-2026-48169 | PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API |
| CVE-2026-48206 | Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP clie... |
| CVE-2026-48494 | TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids |
| CVE-2026-48599 | Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding |
| CVE-2026-4868 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-48759 | TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion) |
| CVE-2026-48765 | TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding |
| CVE-2026-48783 | Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription |
| CVE-2026-48799 | Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook |
| CVE-2026-48826 | HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching |
| CVE-2026-48868 | WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-48872 | WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerability |
| CVE-2026-48912 | Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files... |
| CVE-2026-4896 | WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Pr... |
| CVE-2026-48975 | HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance... |
| CVE-2026-48976 | HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack |
| CVE-2026-49099 | Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client... |
| CVE-2026-49141 | WACRM Authorization Bypass via Automation Engine Endpoint |
| CVE-2026-49192 | Summary Service Insecure Direct Object Reference |
| CVE-2026-49221 | Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets |
| CVE-2026-49222 | Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' p... |
| CVE-2026-49223 | Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' produ... |
| CVE-2026-49224 | Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions |
| CVE-2026-49225 | Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions |
| CVE-2026-49226 | Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts |
| CVE-2026-49227 | Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts |
| CVE-2026-49228 | Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products |
| CVE-2026-49258 | Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) |
| CVE-2026-49296 | Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} |
| CVE-2026-49338 | Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) |
| CVE-2026-49339 | Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other us... |
| CVE-2026-49355 | OpenProject: Private work package data disclosure through single meeting agenda item API |
| CVE-2026-4945 | Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass |
| CVE-2026-49464 | NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak |
| CVE-2026-4958 | OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization |
| CVE-2026-49858 | API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate |
| CVE-2026-5006 | Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths |
| CVE-2026-50141 | Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation |
| CVE-2026-50167 | Kurrier: Authenticated cross-user authorization bypass in Kurrier API |
| CVE-2026-50194 | Steeltoe vulnerable to management-port isolation bypass via spoofed Host header |
| CVE-2026-50198 | Wallos: Cross-user subscription cost inference via replacement_subscription_id |
| CVE-2026-50283 | Craft CMS: Unauthorized Deletion of Source Assets During File Replacement |
| CVE-2026-50530 | DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets |
| CVE-2026-5060 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authentic... |
| CVE-2026-5135 | Foreman: foreman: unauthorized modification of host configurations via broken access control |
| CVE-2026-5138 | Foreman: foreman: information disclosure via improper validation of nested request parameters |
| CVE-2026-5142 | Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass |
| CVE-2026-5167 | Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint |
| CVE-2026-5199 | Cross Namespace Access via Batch Operation |
| CVE-2026-5234 | LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Inv... |
| CVE-2026-5246 | Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization |
| CVE-2026-52699 | WordPress VikRentCar plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-52743 | GoCD before 26.1.0 is vulnerable to authorization bypass via job status API |
| CVE-2026-52779 | OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized pr... |
| CVE-2026-52782 | OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[pro... |
| CVE-2026-52799 | Gogs: Missing Authorization in Attachment Download |
| CVE-2026-52812 | Gogs: LFS dedupe path leaks private repo content across tenants |
| CVE-2026-52820 | Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass |
| CVE-2026-52821 | Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects |
| CVE-2026-52826 | Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulati... |
| CVE-2026-52837 | Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page |
| CVE-2026-52839 | Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypas... |
| CVE-2026-52841 | Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Googl... |
| CVE-2026-52850 | Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces |
| CVE-2026-52869 | MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal |
| CVE-2026-5309 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-5326 | SourceCodester Leave Application System User Information index.php authorization |
| CVE-2026-5337 | Frontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary Download Access via IDOR |
| CVE-2026-53447 | Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID |
| CVE-2026-53470 | Migration-planner: getsourcedownloadurl missing organization check |
| CVE-2026-53471 | Migration-planner: agent api ignores jwt source_id claim |
| CVE-2026-5348 | Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure |
| CVE-2026-53536 | Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL |
| CVE-2026-53546 | Termix: Missing authorization in SSH host credential resolution exposes stored credentials |
| CVE-2026-53548 | Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users |
| CVE-2026-53552 | Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers |
| CVE-2026-53620 | GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this... |
| CVE-2026-53626 | GLPI: Arbitrary Document Read via Form Context Authorization Bypass |
| CVE-2026-53639 | Sylius: IDOR on Shop Payment Request API endpoints |
| CVE-2026-53643 | FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints |
| CVE-2026-53644 | FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders |
| CVE-2026-53673 | BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter |
| CVE-2026-53675 | BuddyPress 14.4.0 Friends List IDOR via REST API |
| CVE-2026-53726 | Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL |
| CVE-2026-53729 | DataEase ExportCenter IDOR allows cross-user export task access |
| CVE-2026-53863 | OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy |
| CVE-2026-53903 | Insecure Direct Object Reference in MCO |
| CVE-2026-53911 | Cerebrate primary key mass assignment in CRUD edit operations allows authenticated users to overwrite unrelated records |
| CVE-2026-5395 | Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter |
| CVE-2026-5396 | Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter |
| CVE-2026-54006 | Open WebUI: Calendar event re-parenting allows writing events into another user's calendar |
| CVE-2026-54009 | Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field |
| CVE-2026-54010 | Open WebUI: Forged chat-file link allows cross-user file read and deletion |
| CVE-2026-54015 | Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion |
| CVE-2026-54016 | Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration |
| CVE-2026-54050 | Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image |
| CVE-2026-54052 | n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments |
| CVE-2026-54097 | File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix |
| CVE-2026-54105 | U.S. GAO EPDS and CBCA EDS user information disclosure |
| CVE-2026-54178 | backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk |
| CVE-2026-54180 | backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) |
| CVE-2026-54184 | WordPress Clean Login plugin <= 1.15 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-54239 | FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope |
| CVE-2026-54256 | Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata |
| CVE-2026-54258 | Cross-monitor event media authorization bypass in direct event media endpoints |
| CVE-2026-54322 | Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles |
| CVE-2026-54324 | Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join |
| CVE-2026-54357 | MISP improper authorization allows organization administrators to modify site administrator user settings |
| CVE-2026-54360 | MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups |
| CVE-2026-54361 | MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records |
| CVE-2026-54529 | SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list` |
| CVE-2026-54553 | Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS |
| CVE-2026-54568 | Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info |
| CVE-2026-5459 | User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticate... |
| CVE-2026-54590 | AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion |
| CVE-2026-54602 | FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord |
| CVE-2026-54622 | django CMS: Clipboard copy IDOR discloses unauthorized plugin content |
| CVE-2026-54641 | OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl |
| CVE-2026-5465 | Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Paramet... |
| CVE-2026-54657 | Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations... |
| CVE-2026-54671 | WeGIA: Authorization Bypass via Empty Resource Array in InternoControle |
| CVE-2026-54683 | NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE... |
| CVE-2026-54746 | Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe |
| CVE-2026-54826 | WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-54839 | WordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulne... |
| CVE-2026-55065 | Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api |
| CVE-2026-55066 | Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id |
| CVE-2026-55067 | Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment |
| CVE-2026-55166 | Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator... |
| CVE-2026-55178 | GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster... |
| CVE-2026-55179 | Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID |
| CVE-2026-55197 | Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint |
| CVE-2026-55198 | Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint |
| CVE-2026-55228 | Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private projec... |
| CVE-2026-5523 | Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Updat... |
| CVE-2026-55234 | Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a... |
| CVE-2026-55255 | Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow |
| CVE-2026-55381 | InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other compa... |
| CVE-2026-55382 | InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR) |
| CVE-2026-55387 | InvoiceShelf bulk deletion lacks company scoping |
| CVE-2026-55411 | ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any... |
| CVE-2026-55418 | FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure) |
| CVE-2026-55429 | Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID |
| CVE-2026-55478 | Snipe-IT: Missing object-level authorization in Kits API |
| CVE-2026-55482 | Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update |
| CVE-2026-55489 | BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass |
| CVE-2026-55515 | Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint |
| CVE-2026-55516 | Snipe-IT: Cross-company asset maintenance re-parenting via API update |
| CVE-2026-55518 | Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Esc... |
| CVE-2026-55544 | NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering |
| CVE-2026-55551 | ZAC: Missing per-zaaktype authorization on by-ID decision and process reads |
| CVE-2026-55561 | InvoicePlane: Guest user IDOR in quote approval and rejection |
| CVE-2026-55583 | Twenty: Cross-workspace IDOR in AgentTurnResolver |
| CVE-2026-55604 | @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key |
| CVE-2026-55610 | InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover |
| CVE-2026-55611 | AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion) |
| CVE-2026-55625 | GoCD is vulnerable to authorization bypass via material connection test APIs |
| CVE-2026-55670 | ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers |
| CVE-2026-55694 | Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover |
| CVE-2026-55739 | Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion |
| CVE-2026-55867 | Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens |
| CVE-2026-55880 | OpenReplay: Cross-user IDOR in notes and dashboard widgets |
| CVE-2026-55881 | OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint |
| CVE-2026-56013 | WordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-56048 | WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR)... |
| CVE-2026-56069 | WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-56093 | Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-56147 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment... |
| CVE-2026-5617 | Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie |
| CVE-2026-56215 | Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning |
| CVE-2026-56222 | Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings |
| CVE-2026-56229 | Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs |
| CVE-2026-56230 | Capgo - Broken Object Level Authorization via x-limited-key-id Header |
| CVE-2026-56385 | Craft CMS - Authorization Bypass in assets/preview-file Endpoint |
| CVE-2026-56422 | MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields |
| CVE-2026-56424 | Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event rep... |
| CVE-2026-5652 | Authorization Bypass Through User-Controlled Key in Crafty Controller |
| CVE-2026-56721 | CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController |
| CVE-2026-56724 | Zammad: Incorrect implementation of permission checks in the knowledge base module |
| CVE-2026-56728 | Zammad: Cross-User Taskbar Item Access Control Vulnerability |
| CVE-2026-56765 | Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR |
| CVE-2026-56772 | NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint |
| CVE-2026-56774 | Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID |
| CVE-2026-56780 | Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API |
| CVE-2026-56781 | Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override |
| CVE-2026-56784 | OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint |
| CVE-2026-56823 | AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering |
| CVE-2026-57205 | SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints |
| CVE-2026-5730 | IDOR in Idvlabs' Ontime |
| CVE-2026-57341 | WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (ID... |
| CVE-2026-57494 | AgenticMail: Cross-agent task authorization bypass in AgenticMail API |
| CVE-2026-57498 | Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers |
| CVE-2026-5750 | Insecure direct object reference (IDOR) vulnerability in Fullstep |
| CVE-2026-57510 | SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC |
| CVE-2026-57630 | WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57634 | WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57646 | WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57652 | WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57665 | WordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57676 | WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57680 | WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57694 | WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57868 | MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroR... |
| CVE-2026-57869 | Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate all... |
| CVE-2026-57870 | Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates use... |
| CVE-2026-57886 | Cross-repository issue/comment attachment re-linking can expose private attachment content |
| CVE-2026-57943 | LibrePhotos < 1.0.0 - Insecure Direct Object Reference in SetPhotosShared Endpoint |
| CVE-2026-57945 | PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint |
| CVE-2026-57956 | SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules |
| CVE-2026-5798 | Unsafe Object Reference (IDOR) vulnerability in Stel Order |
| CVE-2026-5799 | IDOR in Idvlabs' Ontime |
| CVE-2026-58410 | ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records |
| CVE-2026-5842 | decolua 9router Administrative API Endpoint api authorization |
| CVE-2026-58432 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical R... |
| CVE-2026-58435 | Gitea LFS Deploy-Key Privilege Escalation |
| CVE-2026-58445 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API |
| CVE-2026-58447 | Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check |
| CVE-2026-5845 | Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server |
| CVE-2026-58580 | LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes |
| CVE-2026-58650 | Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-58653 | PraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/Update |
| CVE-2026-58660 | Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop |
| CVE-2026-59098 | LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search |
| CVE-2026-59100 | LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations |
| CVE-2026-59185 | identrail: Cross-tenant GitHub installation binding without ownership verification |
| CVE-2026-59190 | Grav Admin Plugin — IDOR Privilege Escalation via saveUser() |
| CVE-2026-59215 | Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding |
| CVE-2026-59216 | Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id |
| CVE-2026-59233 | Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation |
| CVE-2026-59234 | Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion |
| CVE-2026-59235 | Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts |
| CVE-2026-59236 | Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection |
| CVE-2026-59237 | IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders |
| CVE-2026-59240 | IDOR in Prospero Flow CRM allows deletion of other users' notifications |
| CVE-2026-59253 | n8n - Improper Authorization in Workflow Assignment to Folders |
| CVE-2026-59254 | n8n - External Secrets Disclosure via Workflow Node Expressions |
| CVE-2026-59259 | n8n - Permission Bypass via Expression Parser Mismatch in External Secrets |
| CVE-2026-59539 | WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-59546 | WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability |
| CVE-2026-59712 | Leantime - JSON-RPC API Broken Access Control via users.getUser |
| CVE-2026-59733 | rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite a... |
| CVE-2026-59817 | Ghost: Paid gift memberships obtainable at minimal cost via the donations feature |
| CVE-2026-59963 | Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints |
| CVE-2026-59967 | Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pen... |
| CVE-2026-59979 | YosemiteCrew: Missing organization authorization on service and PMS library/template routes |
| CVE-2026-59992 | Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) |
| CVE-2026-6001 | IDOR in Abis Technology's BAPSİS |
| CVE-2026-6008 | IDOR in Im Park's DijiDemi |
| CVE-2026-60104 | Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request |
| CVE-2026-6062 | IDOR in Jira plugin subscription edit endpoint |
| CVE-2026-6063 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-6072 | Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header |
| CVE-2026-61460 | Krayin CRM Insecure Direct Object Reference via Controllers |
| CVE-2026-61574 | authentik RAC: access any endpoint via an unrelated application |
| CVE-2026-61589 | djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve th... |
| CVE-2026-61592 | djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capabilit... |
| CVE-2026-61596 | djust has broken object-level access control (IDOR) |
| CVE-2026-61663 | django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privile... |
| CVE-2026-61671 | WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes |
| CVE-2026-61688 | SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props |
| CVE-2026-61708 | SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user) |
| CVE-2026-61726 | Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe c... |
| CVE-2026-61744 | InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view rol... |
| CVE-2026-61747 | InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappin... |
| CVE-2026-61748 | InvenTree: Report/Label print endpoints ignore per-model permissions |
| CVE-2026-61836 | Directus: Authorization-dependent response served from unsegmented cache key |
| CVE-2026-61838 | Lychee: Album password bypass in ZIP downloads |
| CVE-2026-61946 | WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-61971 | WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-6206 | MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Quer... |
| CVE-2026-62061 | WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-62081 | WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-62113 | WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-6212 | IDOR in Teracity's TeraMIS |
| CVE-2026-62134 | WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-62140 | WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-62233 | grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey |
| CVE-2026-62277 | LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration |
| CVE-2026-62279 | LubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership Check |
| CVE-2026-62283 | Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check |
| CVE-2026-62666 | Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA... |
| CVE-2026-62861 | TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain |
| CVE-2026-62945 | TREK: Cross-trip reservation title disclosure via file links |
| CVE-2026-62991 | Shopper: customer detail IDOR exposes administrator and staff records |
| CVE-2026-63003 | django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass... |
| CVE-2026-63095 | Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint |
| CVE-2026-63099 | TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints |
| CVE-2026-63153 | Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations() |
| CVE-2026-63163 | Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload |
| CVE-2026-63178 | Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-gro... |
| CVE-2026-63204 | Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets |
| CVE-2026-63205 | Zammad: Channel admins can read unauthorized attachments via signature rich-text body |
| CVE-2026-63259 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure |
| CVE-2026-63307 | Chat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasource |
| CVE-2026-63338 | IXP Manager has Broken Object-Level Authorization |
| CVE-2026-63401 | Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser |
| CVE-2026-63458 | Perses project query parameter authorization bypass exposes cross-project resources |
| CVE-2026-63506 | Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site |
| CVE-2026-63647 | CordysCRM SSE Notification Stream Hijack via `/sse/subscribe` |
| CVE-2026-63669 | ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank p... |
| CVE-2026-63735 | SurrealDB before 3.2.0 Authentication Bypass via Custom API |
| CVE-2026-63745 | SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id |
| CVE-2026-32131 | ZITADEL Cross-Tenant Information Disclosure in Management API |
| CVE-2026-33313 | Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments |
| CVE-2026-33345 | solidtime vulnerable to IDOR in private projects |
| CVE-2026-33356 | Meari MQTT broker missing per-device subscribe ACL |
| CVE-2026-33425 | Discourse has inferable private group membership or existence via exclude_groups parameter |
| CVE-2026-33759 | AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents |
| CVE-2026-33760 | Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints |
| CVE-2026-33764 | AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions |
| CVE-2026-33931 | OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access |
| CVE-2026-33934 | OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures |
| CVE-2026-33946 | MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay |
| CVE-2026-34037 | Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() |
| CVE-2026-34044 | Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) |
| CVE-2026-34046 | Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check |
| CVE-2026-34055 | OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification |
| CVE-2026-34167 | Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor |
| CVE-2026-34213 | Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation |
| CVE-2026-34370 | Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes |
| CVE-2026-34444 | Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr |
| CVE-2026-3453 | ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation... |
| CVE-2026-3454 | GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via... |
| CVE-2026-34584 | listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment) |
| CVE-2026-34592 | Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure |
| CVE-2026-34602 | Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses |
| CVE-2026-34985 | LORIS has incorrect access checks in media module |
| CVE-2026-35023 | Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php |
| CVE-2026-35045 | Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification |
| CVE-2026-35147 | HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. |
| CVE-2026-35165 | LORIS has incorrect access checks in document_repository |
| CVE-2026-35173 | Chyrp Lite has an IDOR via Mass Assignment in Post Model |
| CVE-2026-35183 | Brave CMS has an Insecure Direct Object Reference in Article Image Deletion |
| CVE-2026-3688 | WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via U... |
| CVE-2026-39444 | WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39510 | WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39518 | WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39526 | WordPress WpStream plugin < 4.11.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39616 | WordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40252 | Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT |
| CVE-2026-40308 | My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog |
| CVE-2026-40784 | WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40792 | WordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40865 | Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id> |
| CVE-2026-40866 | Horilla: Unauthorized Document Overwrite via File Upload Endpoint |
| CVE-2026-40867 | Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation |
| CVE-2026-40896 | OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup |
| CVE-2026-40907 | WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens |
| CVE-2026-40981 | When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config... |
| CVE-2026-41084 | Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation |
| CVE-2026-41127 | BigBlueButton's missing authorization allows viewer to inject/overwrite captions |
| CVE-2026-41141 | EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup |
| CVE-2026-41160 | EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes |
| CVE-2026-41267 | Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association |
| CVE-2026-41277 | Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR) |
| CVE-2026-41279 | Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials |
| CVE-2026-41649 | Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces |
| CVE-2026-4171 | CodeGenieApp serverless-express API Endpoint TodoList.ts authorization |
| CVE-2026-4208 | Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email) |
| CVE-2026-42097 | Authentication Bypass in Sparx Pro Cloud Server |
| CVE-2026-42291 | SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional |
| CVE-2026-42456 | AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) |
| CVE-2026-42463 | SQLBot: Unauthorized Access Vulnerability |
| CVE-2026-42515 | Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS |
| CVE-2026-42516 | Broken Access Control Vulnerability in e-Sushrut HMIS |
| CVE-2026-42517 | Cryptographic Failure Vulnerability in e-Sushrut HMIS |
| CVE-2026-42572 | Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds` |
| CVE-2026-42609 | Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic |
| CVE-2026-42691 | WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability |
| CVE-2026-42725 | WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-42736 | WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-43917 | Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation |
| CVE-2026-43934 | e107: Broken Access Control in e107 comment edit allows cross-user comment modification |
| CVE-2026-43977 | wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API |
| CVE-2026-4398 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-4400 | Multiple vulnerabilities in 1millionbot Millie chatbot |
| CVE-2026-6583 | TransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization |
| CVE-2026-6584 | TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization |
| CVE-2026-6585 | TransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorization |
| CVE-2026-6586 | TransformerOptimus SuperAGI Budget Endpoint budget.py update_budget authorization |
| CVE-2026-65917 | CyberPanel IncBackups IDOR via Sequential Backup ID |
| CVE-2026-65981 | Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover |
| CVE-2026-66013 | OpenRemote before 1.26.2 Authentication Bypass via Console Registration |
| CVE-2026-66058 | Frappe: Unrestricted access to a Document Follow API |
| CVE-2026-66091 | Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details |
| CVE-2026-6612 | TransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization |
| CVE-2026-6613 | TransformerOptimus SuperAGI agent.py get_schedule_data authorization |
| CVE-2026-6614 | TransformerOptimus SuperAGI project.py get_projects_organisation authorization |
| CVE-2026-66412 | Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC |
| CVE-2026-66575 | WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-66878 | Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.n... |
| CVE-2026-67329 | @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription |
| CVE-2026-67331 | better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass |
| CVE-2026-67342 | ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers |
| CVE-2026-67348 | Julep Insecure Direct Object Reference via GET /executions/{execution_id} |
| CVE-2026-67358 | Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 |
| CVE-2026-67359 | Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 |
| CVE-2026-67360 | Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 |
| CVE-2026-67403 | Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level author... |
| CVE-2026-69250 | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration |
| CVE-2026-69258 | Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API |
| CVE-2026-69558 | Microsoft Partner Center Information Disclosure Vulnerability |
| CVE-2026-6965 | Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET... |
| CVE-2026-70185 | Microsoft PowerShell Security Feature Bypass Vulnerability |
| CVE-2026-70476 | Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation |
| CVE-2026-70488 | Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup |
| CVE-2026-70557 | diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts |
| CVE-2026-70561 | TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php |
| CVE-2026-7145 | mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization |
| CVE-2026-41906 | FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass |
| CVE-2026-41947 | Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints |
| CVE-2026-41949 | Dify < 1.14.2 Authorization Bypass via File Preview Endpoint |
| CVE-2026-41950 | Dify < 1.14.0 Authorization Bypass via File UUID |
| CVE-2026-42205 | Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources |
| CVE-2026-42227 | n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure |
| CVE-2026-42276 | Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions |
| CVE-2026-42277 | Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files |
| CVE-2026-42278 | UltraDAG: Smart Account Spending Policy Bypass via Pockets |
| CVE-2026-42279 | solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID |
| CVE-2026-42861 | Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment |
| CVE-2026-42862 | Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment |
| CVE-2026-42863 | Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment |
| CVE-2026-42889 | Relay Server WebSocket authentication bypass when token is omitted |
| CVE-2026-42947 | Naxclow IoT Platform Authorization bypass through User-Controlled key |
| CVE-2026-4330 | Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Ar... |
| CVE-2026-43883 | WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription... |
| CVE-2026-43890 | Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7) |
| CVE-2026-44083 | QuMagie |
| CVE-2026-44084 | Access Code Forgery in Video Station leading to unauthorized media access |
| CVE-2026-44207 | Frappe: Insecure Direct Object Reference for email accounts |
| CVE-2026-44341 | GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint |
| CVE-2026-44400 | MailEnable Enterprise Premium < 10.55 Authorization Bypass via WebAdmin |
| CVE-2026-44423 | ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data |
| CVE-2026-44424 | ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace |
| CVE-2026-44426 | ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check |
| CVE-2026-44504 | Aegra: Cross-user run injection in /threads/{thread_id}/runs (IDOR) |
| CVE-2026-44544 | gittuf: Policy can be rolled back to prior valid version |
| CVE-2026-44731 | OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET par... |
| CVE-2026-44732 | OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modifi... |
| CVE-2026-44736 | OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects |
| CVE-2026-44776 | Kavita: IDOR in /api/Download/* |
| CVE-2026-45120 | MyBB: Insufficient authorization for private calendar events |
| CVE-2026-45155 | Nextcloud: Private circle can be added to another circle via API |
| CVE-2026-45159 | Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owne... |
| CVE-2026-45281 | Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update |
| CVE-2026-4549 | mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization |
| CVE-2026-45550 | Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body |
| CVE-2026-45551 | Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write |
| CVE-2026-45552 | Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server |
| CVE-2026-45563 | Roxy-WI: IDOR — any authenticated user can read another user's full action history |
| CVE-2026-45732 | n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints |
| CVE-2026-45743 | Termix has a File-Manager Session Hijack via Missing Ownership Check (IDOR) |
| CVE-2026-45746 | Termix Vulnerable to Arbitrary Command Execution via Session Hijacking |
| CVE-2026-45750 | Termix Vulnerable to Arbitrary Command Execution in File Manager |
| CVE-2026-46498 | OpenAM Arbitrary OAuth Token Minting via Push Registration |
| CVE-2026-4654 | Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access v... |
| CVE-2026-46544 | Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requesters |
| CVE-2026-46558 | Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in oth... |
| CVE-2026-46585 | Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP... |
| CVE-2026-46708 | EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record |
| CVE-2026-46712 | Misskey: Lack of proper permission checks in Direct Messaging feature |
| CVE-2026-46721 | Broken Access Control in extension "Frontend User Registration" (sf_register) |
| CVE-2026-46764 | Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter |
| CVE-2026-47068 | Cross-session PubSub topic injection via URL parameter in phoenix_storybook |
| CVE-2026-47094 | SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id} |
| CVE-2026-47130 | NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering |
| CVE-2026-47156 | MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator |
| CVE-2026-47189 | Quest Bot: AutoMod removal can delete rules from another guild by global rule ID |
| CVE-2026-47198 | Paymenter: URL parameter injection bypasses paid plan limits at checkout |
| CVE-2026-47226 | Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileg... |
| CVE-2026-47227 | Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules... |
| CVE-2026-47230 | Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders |
| CVE-2026-47231 | Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folder... |
| CVE-2026-47238 | ClipBucket: IDOR in videos subtitle editor |
| CVE-2026-47266 | Formie: Unauthenticated front-end submission editing can overwrite existing submissions |
| CVE-2026-47415 | praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete... |
| CVE-2026-47417 | praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and... |
| CVE-2026-47418 | praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/de... |
| CVE-2026-47419 | praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete... |
| CVE-2026-47704 | TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bo... |
| CVE-2026-47713 | AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration |
| CVE-2026-47715 | Bugsink: Issue event views can show an event from another project if its UUID is known |
| CVE-2026-47716 | Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known |
| CVE-2026-47743 | Shopper: Multiple data integrity and disclosure issues in admin Livewire components |
| CVE-2026-47755 | ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal |
| CVE-2026-73303 | Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) |
| CVE-2026-73320 | XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint |
| CVE-2026-73395 | WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerabil... |
| CVE-2026-73488 | Flowise before 3.1.3 IDOR via customer-default-source endpoint |
| CVE-2026-73606 | SiYuan before v3.7.4 Information Disclosure via getRefIDs |
| CVE-2026-73610 | SiYuan before v3.7.4 Information Disclosure via Local Storage |
| CVE-2026-73612 | File Browser before v2.63.22 Authorization Bypass via Recursive Operations |
| CVE-2026-73616 | OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference |
| CVE-2026-73644 | OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user witho... |
| CVE-2026-73656 | Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state |
| CVE-2026-73657 | Trigger.dev: Cross-tenant payload poisoning via packet write + replay |
| CVE-2026-73841 | OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints |
| CVE-2026-74771 | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability... |
| CVE-2026-74864 | Authentication Bypass in sogo_yhn |
| CVE-2026-74865 | Authentication Bypass in sogo_yhn |
| CVE-2026-74877 | openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key |
| CVE-2026-75517 | Novu: Cross-Environment Integration Manipulation (IDOR) |
| CVE-2026-7573 | GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations |
| CVE-2026-76287 | Authorization Bypass in the Data Management REST API in Splunk Enterprise |
| CVE-2026-7638 | App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification vi... |
| CVE-2026-76397 | Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit |
| CVE-2026-7648 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to... |
| CVE-2026-7651 | User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Del... |
| CVE-2026-76634 | WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php |
| CVE-2026-7665 | Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX... |
| CVE-2026-76901 | CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accou... |
| CVE-2026-76907 | LaSuite Doc: Public Documents Enumeration |
| CVE-2026-76910 | Unleash: Clone-feature lets a user copy a feature from a project they cannot read |
| CVE-2026-77240 | WACRM: Database-layer authorization bypasses |
| CVE-2026-77293 | TREK: Cross-user note-file deletion (IDOR / Broken Access Control) |
| CVE-2026-77366 | obsidian-tc tokens can access arbitrary configured vaults |
| CVE-2026-77368 | SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths |
| CVE-2026-77385 | Kyoo: Transcoder serves uncataloged files from the media directory |
| CVE-2026-77425 | Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integ... |
| CVE-2026-77426 | Unleash: Missing await on permission check + cross-project IDOR in admin API |
| CVE-2026-77460 | EspoCRM: Mass email template renderer leaks restricted record fields |
| CVE-2026-77516 | MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path |
| CVE-2026-77517 | MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base |
| CVE-2026-77523 | MaxKB: Cross-workspace model parameter form write |
| CVE-2026-77705 | Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover |
| CVE-2026-77759 | IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records |
| CVE-2026-77764 | GamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners |
| CVE-2026-77766 | Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint |
| CVE-2026-77768 | OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access |
| CVE-2026-77769 | OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries |
| CVE-2026-77776 | Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity |
| CVE-2026-77780 | Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosu... |
| CVE-2026-77783 | Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure |
| CVE-2026-77784 | Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as |
| CVE-2026-77785 | Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API |
| CVE-2026-77788 | Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas |
| CVE-2026-77789 | Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR |
| CVE-2026-7782 | CodeCanyon Perfex CRM Tenant Clients.php project authorization |
| CVE-2026-7787 | Unauthenticated Session History Access via Public Flow Execution |
| CVE-2026-77935 | Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers |
| CVE-2026-77937 | Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header |
| CVE-2026-77990 | Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 |
| CVE-2026-77995 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OID... |
| CVE-2026-77998 | Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO <... |
| CVE-2026-78023 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User... |
| CVE-2026-78026 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User... |
| CVE-2026-78064 | Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.... |
| CVE-2026-78065 | Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.2... |
| CVE-2026-78075 | Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 |
| CVE-2026-78139 | Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR |
| CVE-2026-78142 | code-projects Barangay Resident Profiling Management System Restore/Delete archived_records.php authorization |
| CVE-2026-78144 | code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization |
| CVE-2026-78150 | Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR |
| CVE-2026-78160 | Dolibarr ERP User Notes note.php authorization |
| CVE-2026-78203 | Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap |
| CVE-2026-78278 | WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-78310 | Authorization Bypass Through User-Controlled Key in DIAEnergie |
| CVE-2026-78365 | IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification |
| CVE-2026-78371 | File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure |
| CVE-2026-78412 | WatchEvent API streams another organization's live events |
| CVE-2026-78433 | Gitea private attachment disclosure through repository mismatch |
| CVE-2026-78462 | Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-78581 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana |
| CVE-2026-7881 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block |
| CVE-2026-7886 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter |
| CVE-2026-79615 | Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR |
| CVE-2026-79630 | WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution |
| CVE-2026-79654 | Ketello: katello content view history api cross-organization authorization bypass |
| CVE-2026-79750 | MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read +... |
| CVE-2026-79758 | Termix: Authenticated users can read other users' host status and clear global SSH connections |
| CVE-2026-79759 | Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint |
| CVE-2026-79917 | MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation |
| CVE-2026-79957 | ServiceNext Insecure Direct Object Reference via GetUsarios |
| CVE-2026-79990 | GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete |
| CVE-2026-79995 | User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR |
| CVE-2026-80049 | Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId |
| CVE-2026-80197 | Kimai before 2.57.0 Improper Authorization via Favorite Endpoints |
| CVE-2026-80254 | Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log... |
| CVE-2026-8027 | FlowiseAI Flowise User Controller authorization |
| CVE-2026-80311 | Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR |
| CVE-2026-80342 | Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID |
| CVE-2026-80354 | Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace |
| CVE-2026-80434 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81031 | IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update |
| CVE-2026-81182 | SysReptor: Unauthorized file disclosure by broken access control in writable shared notes |
| CVE-2026-81194 | MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter |
| CVE-2026-81196 | MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR |
| CVE-2026-81198 | MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR |
| CVE-2026-81200 | MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR |
| CVE-2026-81210 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81299 | WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-81339 | MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR |
| CVE-2026-81340 | MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR |
| CVE-2026-81424 | Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR |
| CVE-2026-81428 | WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR |
| CVE-2026-81505 | Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials |
| CVE-2026-8155 | BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR |
| CVE-2026-81576 | Improper Authentication of Session Handles |
| CVE-2026-81651 | NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR |
| CVE-2026-81652 | NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR |
| CVE-2026-81653 | NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR |
| CVE-2026-81654 | NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update |
| CVE-2026-81658 | Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup |
| CVE-2026-81668 | Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup |
| CVE-2026-81802 | WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-81817 | Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification |
| CVE-2026-81846 | runZero MCP 'Findings summaries' Data Leak |
| CVE-2026-81853 | AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle |
| CVE-2026-81892 | EasyAdmin custom-action dispatcher bypasses access_control on other routes |
| CVE-2026-81915 | In Concrete CMS below 9.5.3, Page Type update omits object-level authorization |
| CVE-2026-81916 | Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unautho... |
| CVE-2026-8196 | JeecgBoot mLogin Endpoint LoginController.java authorization |
| CVE-2026-8204 | Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog |
| CVE-2026-82125 | Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR |
| CVE-2026-82213 | Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR |
| CVE-2026-82271 | R2R Missing Ownership Check Allows Modifying Other Users' Conversations |
| CVE-2026-82280 | Quivr Prompt Endpoints Missing Ownership Validation |
| CVE-2026-82281 | Kotaemon Missing Ownership Check in Conversation Functions |
| CVE-2026-82283 | VoltAgent Memory API Handlers Missing Ownership Checks |
| CVE-2026-82284 | Quivr Chat Endpoints Missing Ownership Validation |
| CVE-2026-82290 | Chainlit Feedback Endpoints Missing Ownership Validation |
| CVE-2026-82305 | YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title |
| CVE-2026-82323 | Improper Authorization in Enocta Educational's Enocta Platform |
| CVE-2026-82348 | Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups |
| CVE-2026-82395 | Sulu: Media move/update authorization bypass (IDOR) |
| CVE-2026-82411 | Objects API: Cross-object-type authorization bypass on the object history-detail endpoint |
| CVE-2026-82441 | Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys |
| CVE-2026-82564 | Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records |
| CVE-2026-82582 | An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized atta... |
| CVE-2026-82602 | SeaCMS ass.php authorization |
| CVE-2026-82621 | Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization |
| CVE-2026-82685 | Confirmation token accepted on any record in AshAuthentication |
| CVE-2026-82725 | AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data |
| CVE-2026-82816 | dibo-software diboot AI Session Endpoint ai-session authorization |
| CVE-2026-82849 | Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR |
| CVE-2026-82851 | Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR |
| CVE-2026-82869 | ToolJet Database before v3.16.44 Privilege Escalation via join_tables |
| CVE-2026-82870 | ToolJet before v3.16.208 Cross-Tenant Database Manipulation |
| CVE-2026-82872 | ToolJet before v3.16.208 Cross-Workspace Authorization Bypass |
| CVE-2026-82873 | ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export |
| CVE-2026-82874 | ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db |
| CVE-2026-82968 | Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social provid... |
| CVE-2026-8337 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private su... |
| CVE-2026-8347 | Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog |
| CVE-2026-83711 | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability |
| CVE-2026-83743 | invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization |
| CVE-2026-8379 | Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download |
| CVE-2026-83805 | Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jo... |
| CVE-2026-84025 | BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Di... |
| CVE-2026-8406 | openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail |
| CVE-2026-84062 | BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerabili... |
| CVE-2026-84148 | Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System |
| CVE-2026-84150 | Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint |
| CVE-2026-84167 | Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR |
| CVE-2026-84169 | UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery |
| CVE-2026-84205 | GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval |
| CVE-2026-84225 | Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR |
| CVE-2026-84298 | Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher |
| CVE-2026-84460 | Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration |
| CVE-2026-84464 | Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data |
| CVE-2026-84713 | Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privil... |
| CVE-2026-84720 | Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_st... |
| CVE-2026-84769 | WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-84771 | WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-84789 | Broken Access Control vulnerability |
| CVE-2026-84791 | Broken Access Control vulnerability |
| CVE-2026-84796 | Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass |
| CVE-2026-84836 | WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-85009 | RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery |
| CVE-2026-85037 | Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR |
| CVE-2026-85105 | NousResearch hermes-agent Session Management s71.py _sess_nowait authorization |
| CVE-2026-85173 | n8n before 2.36.2 Missing Authorization via Insights API |
| CVE-2026-85177 | CRMEB through 6.0.0 Unauthorized Message Modification via edit_message |
| CVE-2026-85178 | Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter |
| CVE-2026-85182 | vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change |
| CVE-2026-85211 | Label Studio through 1.23.0 Cross-Organization Storage URI Resolution |
| CVE-2026-85214 | vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite |
| CVE-2026-85291 | InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check |
| CVE-2026-6375 | Authorization bypass through User-Controlled key in SpiceJet Online Booking System |
| CVE-2026-63763 | SurrealDB before 2.5.0 Privilege Escalation via Future Fields |
| CVE-2026-6444 | A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific co... |
| CVE-2026-64662 | Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries |
| CVE-2026-64927 | Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.... |
| CVE-2026-64948 | Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure |
| CVE-2026-64961 | Authentication Bypass in ATutor |
| CVE-2026-64969 | Insecure Direct Object Reference in ATutor |
| CVE-2026-65013 | Onlook tRPC Insecure Direct Object Reference via multiple procedures |
| CVE-2026-65016 | n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role |
| CVE-2026-65316 | xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat |
| CVE-2026-6541 | Unscoped updates to other playbooks' metric configuration |
| CVE-2026-6542 | Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id |
| CVE-2026-65456 | WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-65463 | WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-65501 | WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-6552 | Без описания... |
| CVE-2026-65523 | WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vu... |
| CVE-2026-65642 | Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated use... |
| CVE-2026-6566 | Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image... |
| CVE-2026-65696 | Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API |
| CVE-2026-65699 | AgentGPT 1.0.0 Authorization Bypass via Agent Task Creation |
| CVE-2026-6570 | kodcloud KodExplorer systemMember.class.php initInstall authorization |
| CVE-2026-65708 | sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController |
| CVE-2026-65709 | sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API |
| CVE-2026-6571 | kodcloud KodExplorer systemRole.class.php roleGroupAction authorization |
| CVE-2026-65710 | sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption |
| CVE-2026-66634 | WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-66692 | WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (I... |
| CVE-2026-66764 | Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items) |
| CVE-2026-67622 | Flowise 3.1.4 IDOR in OpenAI Assistants Integration |
| CVE-2026-6802 | Easy Upload Files During Checkout <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufd... |
| CVE-2026-68076 | Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection |
| CVE-2026-6810 | Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover |
| CVE-2026-68493 | After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a... |
| CVE-2026-68500 | Sylius Mollie Plugin: Payment status forgery via the payment webhook |
| CVE-2026-68501 | Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII |
| CVE-2026-68527 | Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) i... |
| CVE-2026-68559 | Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`) |
| CVE-2026-68582 | Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token |
| CVE-2026-68870 | Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's C... |
| CVE-2026-68871 | Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variabl... |
| CVE-2026-68872 | Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connec... |
| CVE-2026-69094 | Admidio before 5.0.11 IDOR via save_temporary mylist_function.php |
| CVE-2026-69114 | Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass |
| CVE-2026-69117 | NetBox 4.5.8 ORM Injection via WritableNestedSerializer |
| CVE-2026-69119 | Taubyte Tau v1.1.10 Missing Authorization via GET and DELETE /projects/{id} |
| CVE-2026-69129 | KubePi: Insufficient per-cluster authorization checks in cluster management APIs |
| CVE-2026-69160 | OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API |
| CVE-2026-69189 | Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers |
| CVE-2026-69190 | Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards |
| CVE-2026-69375 | Microsoft Exchange Server Tampering Vulnerability |
| CVE-2026-6976 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-69857 | Azure Cosmos DB Spoofing Vulnerability |
| CVE-2026-69865 | Microsoft Container Registry Elevation of Privilege Vulnerability |
| CVE-2026-71242 | Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy |
| CVE-2026-71251 | Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint |
| CVE-2026-71308 | Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates |
| CVE-2026-71403 | Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind |
| CVE-2026-71404 | Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole |
| CVE-2026-71417 | Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it |
| CVE-2026-7144 | 1000 Projects Portfolio Management System MCA update_passwd_process.php authorization |
| CVE-2026-71854 | OpenAEV has unauthenticated access and missing object-level authorization on player lessons API |
| CVE-2026-72001 | Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint |
| CVE-2026-7201 | CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity |
| CVE-2026-72724 | Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch |
| CVE-2026-72734 | Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registrati... |
| CVE-2026-72737 | Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups |
| CVE-2026-72741 | Rainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access |
| CVE-2026-72763 | n8n before 1.123.67 Credential Exfiltration via Sub-Workflow |
| CVE-2026-72774 | n8n before 1.123.67 Authentication Bypass via HTTP Request Node |
| CVE-2026-72802 | SiYuan before v3.7.4 Information Disclosure via resolveAssetPath |
| CVE-2026-86782 | Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR |
| CVE-2026-8679 | AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter |
| CVE-2026-86837 | Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass |
| CVE-2026-86839 | Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR |
| CVE-2026-87739 | PaperCut MF/NG: User permissions are not evaluated on report generation |
| CVE-2026-87809 | Siyuan before v3.8.2 Information Disclosure via Export Preview |
| CVE-2026-87829 | Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting |
| CVE-2026-8786 | Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization |
| CVE-2026-87894 | Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR |
| CVE-2026-87966 | Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR |
| CVE-2026-87975 | Privilege abuse in model formsets with editable primary keys |
| CVE-2026-87994 | Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint |
| CVE-2026-87997 | Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions |
| CVE-2026-88844 | MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR |
| CVE-2026-88865 | AVideo Missing Authorization via getRestream.json.php |
| CVE-2026-88877 | Traefik v3.7.0 Authentication Bypass via from-to-www-redirect |
| CVE-2026-8890 | code100x Mobile API Authentication Bypass via Header Spoofing |
| CVE-2026-88910 | KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR |
| CVE-2026-88912 | rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR |
| CVE-2026-88927 | rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR |
| CVE-2026-90517 | PHPGurukul Bank Locker Management System view-assign-locker.php authorization |
| CVE-2026-90521 | jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization |
| CVE-2026-90534 | Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method |
| CVE-2026-90542 | WWBN AVideo Missing Authorization via remindMe.json.php |
| CVE-2026-90552 | WWBN AVideo Missing Authorization via Playlists_schedules list.json.php |
| CVE-2026-90598 | jaygajera17 E-commerce-project-springBoot UserController.java UserController.updateUser authorization |
| CVE-2026-90697 | SourceCodester Inventory Management System invoice.php authorization |
| CVE-2026-90858 | subhajitkhan online-clinic-management-system adminappview.php session_start authorization |
| CVE-2026-9087 | Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login |
| CVE-2026-90899 | Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0... |
| CVE-2026-90907 | Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.... |
| CVE-2026-9099 | Keycloak: group-admin escalation to realm-admin |
| CVE-2026-91008 | Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel |
| CVE-2026-91016 | Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure |
| CVE-2026-91025 | Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR |
| CVE-2026-91050 | Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Cr... |
| CVE-2026-91107 | openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR) |
| CVE-2026-91109 | Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Informa... |
| CVE-2026-91144 | ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint |
| CVE-2026-9136 | Unauthorized ShadowAttribute modification in MISP via client-supplied identifier |
| CVE-2026-9152 | Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction |
| CVE-2026-91770 | IceHRM before 36.0.0 Broken Access Control via Employee ID |
| CVE-2026-91773 | Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks |
| CVE-2026-9180 | MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Par... |
| CVE-2026-91846 | MISP Collection Element Add Missing Authorization on Referenced Object UUID |
| CVE-2026-91847 | Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR |
| CVE-2026-9185 | 6Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification v... |
| CVE-2026-9188 | Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference... |
| CVE-2026-91933 | Flowise before 3.1.4 Authorization Bypass via openai-realtime |
| CVE-2026-91984 | Vikunja before 2.6.0 Broken Object-Level Authorization via task-position |
| CVE-2026-91993 | Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list |
| CVE-2026-9225 | Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation |
| CVE-2026-9228 | Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensit... |
| CVE-2026-9241 | FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Con... |
| CVE-2026-92419 | IDOR in WEBCON BPS |
| CVE-2026-92420 | Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR |
| CVE-2026-92421 | Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR |
| CVE-2026-92425 | Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR |
| CVE-2026-92436 | Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR |
| CVE-2026-92468 | microservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center |
| CVE-2026-92469 | microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check |
| CVE-2026-9248 | Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to... |
| CVE-2026-92539 | Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise |
| CVE-2026-92567 | TDuck survey form through 5.0 Unauthorized Data Modification |
| CVE-2026-92577 | AVideo through 29.0 API get_api_video Broken Access Control via clean_title |
| CVE-2026-92588 | n8n before 1.123.76 Improper Authorization via Source Control Push |
| CVE-2026-92603 | ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController |
| CVE-2026-92605 | IRIS through 2.4.29 Unauthorized Comment Access via Object ID |
| CVE-2026-92714 | Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosur... |
| CVE-2026-92715 | Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership... |
| CVE-2026-92716 | Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation |
| CVE-2026-92752 | metasfresh Unauthorized Access via Document Attachments and Comments Endpoints |
| CVE-2026-92765 | ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList |
| CVE-2026-92773 | Trigger.dev before 4.6.0 GitHub App Installation Takeover |
| CVE-2026-92809 | PrestaShop psgdpr through 1.4.3 GDPR Log Forgery |
| CVE-2026-92810 | PrestaShop blockwishlist through 3.0.2 Information Disclosure |
| CVE-2026-9306 | QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization |
| CVE-2026-93366 | Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints |
| CVE-2026-93399 | Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Book... |
| CVE-2026-9341 | Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter |
| CVE-2026-93513 | WordPress SiteSkite plugin <= 2.1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-93538 | Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet |
| CVE-2026-93556 | Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini |
| CVE-2026-93623 | WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-93634 | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records |
| CVE-2026-93660 | SQLBot through 1.10.1 Improper Access Control via Dashboard Update |
| CVE-2026-93661 | Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR |
| CVE-2026-93678 | Langflow OSS is affected by multiple vulnerabilities |
| CVE-2026-93736 | Mealie before 3.21.0 Information Disclosure via Ratings Endpoint |
| CVE-2026-93746 | WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Referen... |
| CVE-2026-93758 | Cross-principal document update, theft, and deletion via unvalidated id in nested attributes |
| CVE-2026-93882 | LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Para... |
| CVE-2026-93955 | grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization |
| CVE-2026-93991 | Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector |
| CVE-2026-94152 | Omega Solution FBP Fulfillment by People User Profile API user authorization |
| CVE-2026-94173 | WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-94180 | WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability |
| CVE-2026-94229 | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter |
| CVE-2026-94245 | Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR |
| CVE-2026-94246 | Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR |
| CVE-2026-94261 | Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id |
| CVE-2026-94374 | MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Rep... |
| CVE-2026-94382 | Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts |
| CVE-2026-94393 | MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport |
| CVE-2026-94405 | WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability |
| CVE-2026-94432 | Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Cre... |
| CVE-2026-94462 | Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR) |
| CVE-2026-94494 | jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info |
| CVE-2026-94497 | jshERP through 3.6 Unauthorized Access via by-id Endpoints |
| CVE-2026-94510 | Microsoft Bookings Elevation of Privilege Vulnerability |
| CVE-2026-94532 | lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById |
| CVE-2026-94533 | lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file |
| CVE-2026-71505 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route |
| CVE-2026-71507 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes |
| CVE-2026-72543 | OpenSignLabs OpenSign - Insecure Direct Object Reference |
| CVE-2026-72545 | OpenSignLabs OpenSign - Insecure Direct Object Reference |
| CVE-2026-72546 | Attendize Attendize - Insecure Direct Object Reference |
| CVE-2026-72547 | Attendize Attendize - Insecure Direct Object Reference |
| CVE-2026-72564 | fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication |
| CVE-2026-72629 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models |
| CVE-2026-72650 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure |
| CVE-2026-72657 | Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure |
| CVE-2026-72662 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of... |
| CVE-2026-72666 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts |
| CVE-2026-72680 | Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification |
| CVE-2026-72689 | OpenSignLabs opensignserver - Broken Object Level Authorization |
| CVE-2026-72690 | Attendize Attendize - Cross-Tenant Authorization Bypass |
| CVE-2026-72863 | Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host |
| CVE-2026-72876 | Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* |
| CVE-2026-73039 | streama Insecure Direct Object Reference via ViewingStatusController |
| CVE-2026-73068 | ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write anoth... |
| CVE-2026-73239 | Apache Allura: Missing permission checks IDOR |
| CVE-2026-73298 | Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes |
| CVE-2026-7399 | IDOR in MeWare Software's PDKS |
| CVE-2026-73999 | WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-74009 | WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-74242 | Quay: repository notification uuid idor in quay api |
| CVE-2026-7491 | Zyosoft｜School App - Insecure Direct Object Reference |
| CVE-2026-74930 | WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR |
| CVE-2026-7502 | LinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization |
| CVE-2026-75033 | Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing |
| CVE-2026-75035 | Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass |
| CVE-2026-7510 | OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization |
| CVE-2026-75101 | Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via... |
| CVE-2026-75103 | Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover |
| CVE-2026-75105 | phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter |
| CVE-2026-75950 | Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 |
| CVE-2026-75951 | Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory <... |
| CVE-2026-76073 | Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset |
| CVE-2026-76087 | Formie: Unauthenticated users can overwrite incomplete submissions via submit action |
| CVE-2026-76089 | Formie: Missing authorization on sent notification resend modal exposes submission PII |
| CVE-2026-76216 | Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing |
| CVE-2026-76236 | stigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones |
| CVE-2026-76237 | stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine |
| CVE-2026-76263 | Improper Access Control through the REST API in Splunk Enterprise |
| CVE-2026-76269 | Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise |
| CVE-2026-76278 | Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise |
| CVE-2026-7681 | jsbroks COCO Annotator Dataset API datasets.py authorization |
| CVE-2026-7702 | toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization |
| CVE-2026-77035 | Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Ma... |
| CVE-2026-77073 | n8n before 2.34.1 Cross-Project Credential Access via MCP |
| CVE-2026-77079 | n8n before 2.34.1 Authorization Bypass via Custom Role Deletion |
| CVE-2026-77081 | n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node |
| CVE-2026-77116 | Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview |
| CVE-2026-77127 | Information Disclosure in extension "Modules" (modules) |
| CVE-2026-77135 | Information Disclosure in extension "femanager" (femanager) |
| CVE-2026-77140 | Broken Access Control in extension "Telephone Directory" (telephonedirectory) |
| CVE-2026-77141 | Broken Access Control in extension "Club Directory" (clubdirectory) |
| CVE-2026-77142 | Broken Access Control in extension "Industry Directory" (yellowpages2) |
| CVE-2026-77143 | Broken Access Control in extension "Forum" (pforum) |
| CVE-2026-77145 | Broken Access Control in extension "Events 2" (events2) |
| CVE-2026-97636 | Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key |
| CVE-2026-97638 | Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via... |
| CVE-2026-97646 | ningzichun student-management-system getStudent.php authorization |
| CVE-2026-97647 | ningzichun student-management-system editLog.php authorization |
| CVE-2026-97657 | Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable... |
| CVE-2026-97685 | LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations |
| CVE-2026-97721 | Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization |
| CVE-2026-85308 | WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-85378 | light0011 cms Chapter Controller ChapterController.class.php _initialize authorization |
| CVE-2026-85381 | light0011 cms Chapter Controller ChapterController.class.php authorization |
| CVE-2026-85389 | Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints |
| CVE-2026-85392 | Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint |
| CVE-2026-85571 | Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR |
| CVE-2026-85579 | SiYuan before v3.8.2 Information Disclosure via undoState |
| CVE-2026-85594 | Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware |
| CVE-2026-85607 | Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router |
| CVE-2026-85611 | OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures |
| CVE-2026-85615 | Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts |
| CVE-2026-85616 | Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance |
| CVE-2026-85617 | snipe-it before 8.6.3 Authorization Bypass via Bulk Delete |
| CVE-2026-85624 | Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList |
| CVE-2026-85638 | jofpin trape user.py authorization |
| CVE-2026-85693 | Chatbot UI Cross-User Private File Content Disclosure via Retrieval API |
| CVE-2026-85749 | MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail |
| CVE-2026-85873 | Skype for Business Elevation of Privilege Vulnerability |
| CVE-2026-8611 | Klamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information... |
| CVE-2026-86111 | BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses |
| CVE-2026-86112 | BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints |
| CVE-2026-86113 | BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Record... |
| CVE-2026-86174 | Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board |
| CVE-2026-86176 | NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs |
| CVE-2026-86183 | diem-project diem dmWidget BasedmWidgetActions.class.php authorization |
| CVE-2026-86191 | SiYuan before v3.8.2 Private Attribute View Key Enumeration |
| CVE-2026-86192 | SiYuan before v3.8.2 Information Disclosure via Attribute-View |
| CVE-2026-86261 | sfturing hosp_order Order Controller OrderController.java authorization |
| CVE-2026-86262 | sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization |
| CVE-2026-86263 | sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization |
| CVE-2026-86277 | SourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php authorization |
| CVE-2026-8629 | Crabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpoints |
| CVE-2026-86408 | MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events |
| CVE-2026-86451 | MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects |
| CVE-2026-86465 | Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key |
| CVE-2026-86678 | Broken Authentication vulnerability |
| CVE-2026-86720 | WWBN AVideo Missing Authorization via resendRestreamer.json.php |
| CVE-2026-86725 | AVideo SocialMediaPublisher Missing Authorization via add.json.php |
| CVE-2026-86743 | Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report |
| CVE-2026-86761 | snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints |
| CVE-2026-86763 | snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer |
| CVE-2026-87019 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87025 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87033 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87047 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87098 | Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 17... |
| CVE-2026-87108 | Ops Manager Improper Authorization in Daily Host Monitoring Retrieval |
| CVE-2026-87113 | Tanium addressed an improper access controls vulnerability in Threat Response. |
| CVE-2026-88065 | `tts-be` application has a Broken Access Control vulnerability |
| CVE-2026-8828 | A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to a... |
| CVE-2026-8839 | MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints |
| CVE-2026-88978 | Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id... |
| CVE-2026-89004 | WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR |
| CVE-2026-89029 | Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler |
| CVE-2026-89031 | Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post |
| CVE-2026-89063 | Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data... |
| CVE-2026-89140 | Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler... |
| CVE-2026-89141 | AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'med... |
| CVE-2026-89199 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict ac... |
| CVE-2026-89202 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform aut... |
| CVE-2026-89204 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict ac... |
| CVE-2026-89252 | AVideo Missing Authorization in addLiveLink.php LiveLink Update |
| CVE-2026-89257 | AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check |
| CVE-2026-89262 | MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check |
| CVE-2026-89264 | MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity |
| CVE-2026-89280 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (... |
| CVE-2026-89333 | Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'stud... |
| CVE-2026-94534 | lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints |
| CVE-2026-94535 | lamp-cloud through 5.10.0 Unauthorized Notification Deletion |
| CVE-2026-94536 | lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource |
| CVE-2026-94672 | WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-94673 | WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-9493 | BankPro E-Service Technology｜Service Center - Insecure Direct Object Reference |
| CVE-2026-95592 | WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-95602 | WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-95655 | Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel |
| CVE-2026-95683 | MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL |
| CVE-2026-9589 | Unblu Spark Authorization Bypass in Configuration Cascade Operations |
| CVE-2026-96173 | Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR |
| CVE-2026-96271 | Photoview through 2.4.0 Authorization Bypass via shareAlbum |
| CVE-2026-96347 | WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-96451 | WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability |
| CVE-2026-96581 | An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another t... |
| CVE-2026-96762 | kvcache-ai mooncake RPC Path UnmountSegment authorization |
| CVE-2026-96900 | Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR |
| CVE-2026-97060 | X-SpringBoot through 6.0 Authorization Bypass via User Management |
| CVE-2026-97066 | WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97070 | WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97074 | WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR)... |
| CVE-2026-97078 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97079 | WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-9708 | Incoming webhook user attribution via unvalidated webhook owner |
| CVE-2026-9712 | Insecure direct object reference |
| CVE-2026-97251 | WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97255 | WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97259 | WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97269 | WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97282 | WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97305 | WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97368 | chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization |
| CVE-2026-97898 | Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms |
| CVE-2026-9799 | Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass |
| CVE-2026-9812 | Missing property field ownership validation in Playbooks run property update endpoint |
| CVE-2026-9851 | Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action |
Exploits & Shellcodes
| Идентификатор | Тип | Описание | Дата публикации |
|---|---|---|---|
| EDB-52687 | Exploit | Krayin CRM 2.2.4 - IDOR | 01.10.2026 |
| EDB-52464 | Exploit | Chained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie | 25.12.2025 |
| EDB-52302 | Exploit | WordPress User Registration & Membership Plugin 4.1.2 - Authentication Bypass | 25.05.2025 |
| EDB-52291 | Exploit | WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation | 13.05.2025 |
| EDB-52264 | Exploit | UJCMS 9.6.3 - User Enumeration via IDOR | 18.04.2025 |
| EDB-51659 | Exploit | Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR | 04.08.2023 |
CISA KEV - известные эксплуатируемые уязвимости
Записи каталога CISA, для которых известны факты активной эксплуатации
| Идентификатор | Дата добавления | Описание | Ransomware |
|---|---|---|---|
| CVE-2026-55255 | 07.07.2026 | Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifyi... | Нет |
НКЦКИ уязвимости
Бюллетени НКЦКИ - уязвимости ПО
| Идентификатор | Дата бюллетеня | Описание |
|---|---|---|
| VULN:20231222-28 | 22.12.2023 | Обход безопасности в ETL3100 |
| VULN:20240110-7 | 10.01.2024 | Обход безопасности в SIMATIC CN 4100 |
| VULN:20240325-20 | 25.03.2024 | Получение конфиденциальной информации в FortiOS |
| VULN:20240916-18 | 16.09.2024 | Обход безопасности в Siemens Industrial Edge Management |
| VULN:20260610-28 | 10.06.2026 | Внедрение кода в Gitlab |
| VULN:20260610-67 | 10.06.2026 | Получение конфиденциальной информации в moodle-mod_customcert |
| VULN:20260819-101 | 19.08.2026 | Обход безопасности в Langflow |
| VULN:20260909-82 | 09.09.2026 | Чтение локальных файлов в Flowise |
| VULN:20260917-134 | 17.09.2026 | Повышение привилегий в SolarWinds Serv-U |
| VULN:20260917-135 | 17.09.2026 | Повышение привилегий в SolarWinds Serv-U |
| VULN:20260917-137 | 17.09.2026 | Повышение привилегий в SolarWinds Serv-U |
| VULN:20260917-142 | 17.09.2026 | Повышение привилегий в SolarWinds Serv-U |
| VULN:20260917-154 | 17.09.2026 | Повышение привилегий в Microsoft Azure Active Directory B2C |
| VULN:20260917-155 | 17.09.2026 | Выполнение произвольного кода в SolarWinds Serv-U |
| VULN:20260917-172 | 17.09.2026 | Выполнение произвольного кода в SolarWinds Serv-U |
| VULN:20260917-205 | 17.09.2026 | Выполнение произвольного кода в SolarWinds Serv-U |
| VULN:20260923-192 | 23.09.2026 | Обход безопасности в SeaweedFS |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.