Каталоги
В сервис интегрированы наиболее популярные публичных базы знаний:
- Сертификаты СЗИ - Государственный реестр сертифицированных средств защиты информации опубликованный Федеральной службой по техническому и экспортному контролю, может быть использован для контроля актуальности используемых СЗИ в организации.
- CWE уязвимости - общедоступная публичная база распространенных типов уязвимостей в программном и аппаратном обеспечении, которые могут иметь последствия для безопасности - Common weakness enumeration.
- CVE уязвимости - общедоступная публичная база уязвимостей Common Vulnerabilities and Exposures (CVE). Миссия программы CVE заключается в выявлении, определении и каталогизации публично раскрываемых уязвимостей в сфере кибербезопасности. Для каждой уязвимости в каталоге существует одна запись CVE. Уязвимости обнаруживаются, затем присваиваются и публикуются организациями по всему миру, которые сотрудничают с программой CVE. Партнеры публикуют записи CVE для единообразного описания уязвимостей. Специалисты в области информационных технологий и кибербезопасности используют записи CVE, чтобы убедиться, что они обсуждают одну и ту же проблему, и координировать свои усилия по определению приоритетности и устранению уязвимостей.
- БДУ ФСТЭК уязвимости - раздел Уязвимости Банка данных уязвимостей опубликованная Федеральной службой по техническому и экспортному контролю совместно с Государственным научно-исследовательским испытательным институтом проблем технической защиты информации. Одной из целей создания банка данных угроз безопасности информации является объединение специалистов в области информационной безопасности для решения задач повышения защищенности информационных систем.
- НКЦКИ уязвимости - общедоступная публичная база уязвимостей Национального координационного центра по компьютерным инцидентам (НКЦКИ), обеспечивающего координацию деятельности субъектов КИИ по обнаружению, предупреждению, ликвидации последствий компьютерных атак и реагированию на компьютерные инциденты.
- MITRE ATT&CK – Adversarial Tactics, Techniques & Common Knowledge – Тактики, техники и общеизвестные знания о злоумышленниках. Это основанная на реальных наблюдениях база знаний компании Mitre, содержащая описание тактик, приемов и методов, используемых киберпреступниками. База создана в 2013 году и регулярно обновляется, цель – составление структурированной матрицы используемых киберпреступниками приемов, чтобы упростить задачу реагирования на киберинциденты.
- БДУ ФСТЭК и Новая БДУ ФСТЭК – раздел Угрозы Банка данных угроз, опубликованный в 2015 году Федеральной службой по техническому и экспортному контролю и Государственным научно-исследовательским испытательным институтом проблем технической защиты информации, обязателен при моделировании угроз при построении систем защиты персональных данных, критической информационной инфраструктуры, государственных информационных систем.
- Exploits & Shellcodes - база данных эксплойтов поддерживается OffSec, обучающей компанией по информационной безопасности, которая предоставляет различные сертификаты по информационной безопасности, а также услуги по тестированию на проникновение высокого класса.
Каталог Справка открывает раздел документации по каталогам.
Уязвимости CVE, БДУ ФСТЭК и НКЦКИ
Каталоги CVE уязвимости, БДУ ФСТЭК уязвимости и НКЦКИ уязвимости предоставляют дополнительный контент и обогащают информацией описание уязвимостей от сканеров в модуле Технические уязвимости.
Интерфейс каталогов идентичен и содержит следующие блоки:
- Метрики:
- Найденные уязвимости – отображает количество найденных в отчетах от сканеров уязвимостей которые связаны с уязвимостями из каталога, при нажатии на виджет перенаправляет в модуль Технические уязвимости с установленным фильтром по названию каталога (тип фильтра Группа уязвимостей);
- Уязвимые хосты – отображает количество хостов на которых обнаружены уязвимости связанные с уязвимостями из каталога, при нажатии на виджет перенаправляет в модуль Технические уязвимости с установленным фильтром по названию каталога (тип фильтра Группа уязвимостей).
- Табличную часть Каталог уязвимостей:
- Фильтр по полю Идентификатор - особенностью данного фильтра является автоматический разбор текста с последующим извлечением из текста идентификаторов. Для этого необходимо вставить произвольный текст с идентификаторами в поле и добавить в фильтр через кнопку плюс;
- Табличную часть с полями для каталогов CVE и БДУ ФСТЭК:
- Идентификатор - id уязвимости в базе уязвимостей;
- Описание - текстовое описание уязвимости;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- CVSS - числовая оценка уязвимости согласно источнику, с указанием даты выявления уязвимости экспертами, оценка отображается цветом согласно оценке CVSS 0.1 – 3.9 Low Зеленый,
4.0 – 6.9 Medium Желтый, 7.0 – 8.9 High Оранжевый, 9.0 – 10.0 Critical Красный.
- Табличную часть с полями для каталогов CVE :
- Дата бюллетеня - информация о дате публикации бюллетеня содержащего уязвимости;
- Идентификатор - id уязвимости в базе уязвимостей;
- Информация - текстовое описание уязвимости;
- Вектор атаки - локальный или сетевой вектор атаки;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Наличие обновления - - флаг, данный статус отображается если база уязвимостей содержит информацию о наличии обновлений от производителя уязвимого ПО;
- Дата выявления - даты выявления уязвимости экспертами.
- Чекбокс «Только обнаруженные уязвимости» - устанавливает фильтр на табличную часть для отображения только обнаруженные уязвимости.
- Функционал для экспорта всех уязвимостей каталога.
- Для каталога добавляется функционал Варианты отображения:
- Бюллетени - изменяет отображение табличной части на реестр бюллетеней, отображает общее количество уязвимостей в бюллетени в поле Уязвимостей в бюллетени и статус по обнаружению в поле Обнаружено - данный статус отображается если хотя бы одна уязвимость из бюллетеня обнаружена в инфраструктуре.
- Уязвимости.
Каталог Exploits & Shellcodes
Каталог используется для обогащения информацией карточек уязвимостей. Каталог хранит описания готовых скриптов и кода, для эксплуатации уязвимостей, из публичного источника Exploit-DB. В карточке эксплойта отображаются все атрибуты, блоки связанные с каталогами уязвимостей CVE, БДУ, НКЦКИ, CWE.
Интерфейс каталогов идентичен и содержит следующие блоки:
Табличную часть Каталог уязвимостей:
Интерфейс каталогов идентичен и содержит следующие блоки:
Табличную часть Каталог уязвимостей:
- Фильтр по типу (exploit или shellcode);
- Фильтр по полю Платформа;
- Чекбокс «Только проверенные» - устанавливает фильтр на табличную часть для отображения только проверенных уязвимостей.
Табличную часть с полями:
- Идентификатор - id уязвимости в базе уязвимостей;
- Тип - к какому типу относится уязвимость Exploit / Shellcode;
- Описание - текстовое описание уязвимости;
- Платформа - на каких платформах проявляется;
- Дата публикации - информация о дате публикации;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Проверено - флаг, данный статус отображается если уязвимость является проверенной.
MITRE ATT&CK, БДУ ФСТЭК, Новая БДУ ФСТЭК
Данные из каталогов MITRE ATT&CK, БДУ ФСТЭК, Новая БДУ ФСТЭК могут использоваться для контекстного наполнения риска в модуле Риски.
Каждый из указанных каталогов сформирован по собственной схеме данных, которая не соответствует подходу оценки риска, используемому в сервисе. Но в основе своей указанные базы описывают все те же риски информационной безопасности, каждый под своим углом. Поэтому они добавлены в сервис и как отдельные компоненты и как основа для создания рисков, угроз или уязвимостей.
Каталоги могут использоваться в сервисе с целью:
- Облегчения процесса формирования рисков, угроз и уязвимостей;
- Обогащения информации по рискам (угрозам, уязвимостям) созданным в сервисе.
- Взгляда на компанию и оценку рисков через публичные каталоги угроз.
Сервис позволяет установить связь между объектами из каталогов и 3 типами объектов сервиса: угрозами, уязвимостями или рисками безопасности:
- Уязвимости могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK и способами реализации Новой БДУ ФСТЭК.
- Угрозы могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK, угрозами и последствиями Новой БДУ ФСТЭК.
- Риски могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK, угрозами, способами реализации и последствиями Новой БДУ ФСТЭК.
Такой широкий выбор возможных связей сделан потому, что объекты из каталогов угроз могут быть или угрозой или уязвимостью в контексте сервиса.
Например, УБИ.004 Угроза аппаратного сброса пароля BIOS из БДУ ФСТЭК в контексте сервиса является уязвимостью, особенностью активов типа Микропрограммное обеспечение, которая может привести к реализации угрозы Несанкционированного локального доступа к BIOS.
В большинстве случаев угрозы из БДУ ФСТЭК и техники из MITRE ATT@CK являются именно уязвимостями, использование которых ведет к реализации угроз безопасности, но бывают и исключения.
Для рисков, угроз и уязвимостей из базы Community связи с каталогами угроз уже установлены.
Связь с каталогом угроз может быть прямой или косвенной. Например, если уязвимость связана с угрозой из БДУ ФСТЭК то и все риски, в составе которых есть данная уязвимость будут автоматически связаны с угрозой из БДУ ФСТЭК.
Каталог БДУ ФСТЭК - это реестр рисков от банка данных угроз безопасности информации ФСТЭК России.
Каждая угроза содержит описание, рекомендации к каким типам активов может быть применена эта угроза, классификация по свойствам информации и вероятные источники угрозы. Дополнительно в блоке Связанные риски указаны связанные риски, а в блоке Каталоги указываются связи с записями из других каталогов.
Каталог Новая БДУ ФСТЭК от банка данных угроз безопасности информации ФСТЭК России содержит:
- матрицу Способы реализации (возникновения угроз) - каждая ячейка которых содержит описание поверхности атаки: группу способов, уровень возможностей нарушителя, возможные реализуемые угрозы, компоненты объектов воздействия, возможные меры защиты;
- Негативные последствия - перечень негативных последствий в классификации ФСТЭК в виде кода и описания;
- Угрозы - реестр угроз с описанием, каждая угроза содержит возможные объекты воздействия и возможные способы реализации угроз;
- Объекты - перечень объектов последствий с описанием и компонентами которые могут входить в состав объекта;
- Компоненты - перечень компонентов объектов воздействия с указанием объектов воздействия на которых они могут располагаться;
- Нарушители - уровни возможностей нарушителей классифицированные по возможностям и компетенции;
- Меры защиты - в терминологии SECURITM это список требований выполнение которых сокращает возможности нарушителя.
Каталог MITRE ATT&CK содержит:
- Матрица - содержит тактики и техники злоумышленника, позволяет на основании тактики или техники создать риск или уязвимость, в матрице указаны связи с рисками в базе Community и с рисками в базе команды;
- Тактики - направления действия нарушителя на том или ином этапе cyberkillchane;
- Техники - конкретные действия нарушителя для достижения цели на конкретном шаге cyberkillchane;
- Контрмеры - в терминологии SECURITM это список требований выполнение которых сокращает возможности нарушителя;
- Преступные группы - описание APT группировок и их особенности и модель поведения;
- Инструменты - ПО используемое нарушителями для вредоносного воздействия.
Матрицы могут использоваться для построения тепловой карты рисков наложенных на матрицы угроз и уязвимостей.
Уязвимости CWE
Каталог CWE уязвимости предоставляет дополнительный контент и обогащают информацией описание уязвимостей от сканеров в модуле Технические уязвимости.
Интерфейс каталогов идентичен и содержит следующие блоки:
- Табличную часть Каталог уязвимостей:
- Фильтр по полю Идентификатор;
- Табличную часть с полями:
- Идентификатор - id уязвимости в базе уязвимостей;
- Имя - текстовое описание уязвимости;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Чекбокс «Только обнаруженные уязвимости» - устанавливает фильтр на табличную часть для отображения только обнаруженные уязвимости.
Сертификаты СЗИ
Каталог Сертификаты СЗИ может быть использован в модуле Активы как источник информации для поля Номер сертификата СЗИ. В модуле активов есть возможность вести реестр СЗИ используемых в организации, в свою очередь каталог сертификатов СЗИ позволяет связать актив с каталогом через поле актива Номер сертификата СЗИ.
Каталог Сертификаты СЗИ содержит реестр с информацией о номере сертификата, сроке действия сертификата и сроке поддержки СЗИ. Кроме реестра каталог содержит следующие метрики:
- Имеющиеся СЗИ - отображает количество активов у которых заполнено поле Номер сертификата СЗИ;
- Скоро будут просрочены - отображает количество активов у которых срок действия сертификата меньше 90 календарных дней;
- Просроченные сертификаты - отображает количество активов у которых срок действия сертификата уже истек;
- Истекшая поддержка - отображает количество активов у которых срок действия сертификата уже истек.
Каждая метрика ведёт в реестр активов и выводит список СЗИ, отфильтрованный по соответствующим параметрам.
Нажав на просмотр сертификата, мы увидим карточку сертификата, сервис хранит информацию о следующих данных:
- Номер сертификата;
- Дата внесения в реестр;
- Срок действия сертификата;
- Срок окончания тех. поддержки;
- Наименование средства (шифр);
- Схема сертификации;
- Испытательная лаборатория;
- Орган по сертификации;
- Заявитель;
- Наименования документов соответствия;
- Реквизиты заявителя.
Реестр обновляется автоматически один раз в месяц.
При выборе или изменении значения поля Номер сертификата СЗИ в карточке актива связанные поля заполняются автоматически из данных сертификата: проставляется признак Сертифицировано, а также срок действия сертификата и срок окончания технической поддержки. При очистке поля Номер сертификата СЗИ эти поля очищаются. Заполнение происходит автоматически, отдельно вносить эти значения вручную не требуется.
При выборе или изменении значения поля Номер сертификата СЗИ в карточке актива связанные поля заполняются автоматически из данных сертификата: проставляется признак Сертифицировано, а также срок действия сертификата и срок окончания технической поддержки. При очистке поля Номер сертификата СЗИ эти поля очищаются. Заполнение происходит автоматически, отдельно вносить эти значения вручную не требуется.
Куда я попал?
CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
| Тип уязвимости: | Не зависит от других уязвимостей |
| Вероятность эксплойта: |
High
|
Идентификаторы ФСТЭК уязвимостей
Идентификатор, базы данных общеизвестных уязвимостей информационной безопасности
| Идентификатор | Описание |
|---|---|
| BDU:2015-11945 | Уязвимость веб-приложения для синхронизации данных ownCloud, позволяющая нарушителю читать данные произвольных календарей |
| BDU:2019-01142 | Уязвимость пакета для настройки виртуальной машины cloud-init операционных систем семейства Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2020-00117 | Уязвимость программного средства McAfee Client Proxy, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обходить сканирование веб-трафика и получать доступ к заблокированным сайтам |
| BDU:2020-01954 | Уязвимость функции local_graph_id системы мониторинга сервера Cacti, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить доступ к конфиденциальным данным |
| BDU:2020-05534 | Уязвимость компонента xAPI микропрограммного обеспечения устройства управления конференц-связью Cisco TelePresence Collaboration Endpoint (CE) и операционной системы Cisco RoomOS, позволяющая нарушителю выполнить произвольный код |
| BDU:2021-03179 | Уязвимость универсальной системы мониторинга Zabbix, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обойти страницу входа и получить доступ к странице панели инструментов |
| BDU:2021-04525 | Уязвимость системы аутентификации для веб-приложений LemonLDAP::NG, связанная с ошибкой обработки ключей авторизации, позволяющая нарушителю проводить спуфинг-атаки |
| BDU:2022-01309 | Уязвимость службы Key Storage Provider (KSP) операционной системы Microsoft Windows, позволяющая нарушителю обойти процесс аутентификации |
| BDU:2022-04072 | Уязвимость программного средства создания веб-служб go-restful, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая наруштителю повысить свои привилегии |
| BDU:2023-02460 | Уязвимость микропрограммного обеспечения контроллеров Nexx Garage Door Controller (NXG-100B, NXG-200), Nexx Smart Plug (NXPG-100W), Nexx Smart Alarm (NXAL-100), связанная с обходом авторизации посредством использования ключа, контролируемого пользова... |
| BDU:2023-02461 | Уязвимость микропрограммного обеспечения контроллеров Nexx Garage Door Controller (NXG-100B, NXG-200), Nexx Smart Plug (NXPG-100W), Nexx Smart Alarm (NXAL-100), связанная с обходом авторизации посредством использования ключа, контролируемого пользова... |
| BDU:2023-02620 | Уязвимость платформы автоматизации NGINX Instance Manager, диспетчера подключений API NGINX API Connectivity Manager и платформы мониторинга и управления безопасностью NGINX Security Monitoring, связанная с обходом авторизации посредством использован... |
| BDU:2023-05478 | Уязвимость инструмента проверки кода Crucible, инструмента поиска и сравнения кода Fisheye , связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой инфор... |
| BDU:2023-06062 | Уязвимость компонента graph_xport.php программного средства мониторинга сети Cacti, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06462 | Уязвимость программного обеспечения защиты данных Acronis Cyber Protect 15, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06463 | Уязвимость программного обеспечения защиты данных Acronis Cyber Protect 15, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06699 | Уязвимость программного средства для централизованного управления устройствами Fortinet FortiManager, межсетевого экрана FortiAnalyzer, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить до... |
| BDU:2023-06795 | Уязвимость программных платформ для разработки и управления онлайн магазинами Magento Open Source и Adobe Commerce, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06799 | Уязвимость функции аутентификации SASL Quorum Peer централизованной службы для поддержки информации о конфигурации, именования, обеспечения распределенной синхронизации и предоставления групповых служб Apache ZooKeeper, позволяющая нарушителю обойти... |
| BDU:2023-07494 | Уязвимость программного обеспечения мониторинга банкоматов ScrutisWeb, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-07999 | Уязвимость плагинов EventOn Lite и EventON системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-08301 | Уязвимость программного обеспечения автоматизации службы поддержки и контроля аппаратного и программного обеспечения SysAid, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получи... |
| BDU:2023-09003 | Уязвимость микропрограммного обеспечения телетрансляторов EuroTel ETL3100 и EuroTel ETL3100RT, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обойти ограничения безопасности, пол... |
| BDU:2024-00276 | Уязвимость процесса промежуточной установки микропрограммного обеспечения коммуникационного шлюза SIMATIC CN 4100, позволяющая нарушителю войти в систему и получить полный контроль над приложением |
| BDU:2024-01987 | Уязвимость компонента SSL-VPN операционных систем FortiOS и прокси-сервера для защиты от интернет-атак FortiProxy, позволяющая нарушителю получить несанкционированный доступ к веб-странице другого пользователя |
| BDU:2024-02400 | Уязвимость операционной системы FortiOS, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации |
| BDU:2024-02546 | Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с обходом авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-03194 | Уязвимость службы secondscreen.gateway операционной системы LG WebOS для телевизоров LG, позволяющая нарушителю создать привилегированную учетную запись пользователя |
| BDU:2024-03857 | Уязвимость программного средства корпоративной телефонии FortiVoice связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю раскрыть конфигурационные SIP-файлы |
| BDU:2024-04116 | Уязвимость веб-инструмента представления данных Grafana, связанная с обходом авторизации, позволяющая нарушителю обойти процесс авторизации и удалить моментальный снимок |
| BDU:2024-04604 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2024-05341 | Уязвимость программной платформы интеграции данных IBM InfoSphere Information Server, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю раскрыть защищаемую информацию или изменить произвольные данн... |
| BDU:2024-06159 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с ошибкой обработки токенов LFS, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и записывать произвольные файлы |
| BDU:2024-06229 | Уязвимость интерфейса администрирования инструмента аналитики и управления безопасностью Fortinet FortiPortal, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2024-07659 | Уязвимость компонента Group Member Handler программной платформы на базе git для совместной работы над кодом GitLab, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-07780 | Уязвимость программной платформы создания веб-приложений Next.js, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2024-08483 | Уязвимость операционной системы Junos OS Evolved, связанная с обходом авторизации посредством использования ключа, позволяющая нарушителю обойти существующие ограничения безопасности, войти в систему и получить полный контроль над устройством |
| BDU:2024-08756 | Уязвимость программного обеспечения защиты данных Acronis Cyber Protect 16, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-08968 | Уязвимость микропрограммного обеспечения роутеров TOTOLINK LR350, связанная с недостатками процедуры авторизации, позволяющая нарушителю обойти ограничения безопасности |
| BDU:2024-09384 | Уязвимость платформы централизованного управления промышленными периферийными приложениями и устройствами Siemens Industrial Edge Management (IEM), связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позвол... |
| BDU:2024-10391 | Уязвимость интерфейса администрирования инструмента аналитики и управления безопасностью Fortinet FortiPortal, позволяющая нарушителю взаимодействовать с ресурсами других организаций |
| BDU:2024-10862 | Уязвимость компонента cgi-bin/ocap/ библиотечной системы AbsysNet, позволяющая нарушителю реализовать атаку методом "грубой силы" (brute force) |
| BDU:2024-11319 | Уязвимость пакета клиентской и серверной реализации протокола SSHv2 asyncssh интерпретатора языка программирования Python, позволяющая нарушителю проводить атаки типа "человек по середине" |
| BDU:2024-11391 | Уязвимость платформы для мониторинга, управления и улучшения приложений LLM Lunary, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на целостность и конфиденциальн... |
| BDU:2024-11393 | Уязвимость функции "Evaluations" платформы для мониторинга, управления и улучшения приложений LLM Lunary, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2024-11482 | Уязвимость службы Streaming Service медиасервера Synology Media Server, позволяющая нарушителю читать произвольные файлы |
| BDU:2024-11512 | Уязвимость программного средства для централизованного управления устройствами Fortinet FortiManager, межсетевого экрана FortiAnalyzer, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая наруши... |
| BDU:2025-00548 | Уязвимость микропрограммного обеспечения многоконтурного измерителя электрического напряжения PowerLogic HDPM6000, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю повысить свои пр... |
| BDU:2025-00581 | Уязвимость инструментов для автоматизации бизнес-процессов в системе SAP SAP Business Workflow и SAP Flexible Workflow, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить не... |
| BDU:2025-01981 | Уязвимость веб-инструмента представления данных Grafana, связанная с обходом авторизации с помощью ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2025-02019 | Уязвимость плагина Meetup системы управления содержимым сайта WordPress, связанная сбходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-02550 | Уязвимость панели приложений в реальном времени управления содержимым базы данных SQL Directus, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить доступ к учётной записи по... |
| BDU:2025-02561 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab Enterprise Edition, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-02938 | Уязвимость платформы автоматизации процессов электронного документооборота Documino, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаем... |
| BDU:2025-03630 | Уязвимость компонента Manage Bank Statements программной платформы SAP S/4HANA, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2025-03631 | Уязвимость платформы проектирования бизнес-приложений SAP Fiori, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2025-03853 | Уязвимость компонента Sherpa Orchestrator платформы для автоматизации процессов Sherpa RPA, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-04613 | Уязвимость системы автоматизации рекрутинговых процессов E-Staff, связанная с ошибками фильтрации данных при получении информации об объекте, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05103 | Уязвимость виртуальной обучающей среды Moodle, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05106 | Уязвимость компонента RSS Block виртуальной обучающей среды Moodle, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05111 | Уязвимость компонента Multi-Factor Authentication виртуальной обучающей среды Moodle, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2025-05996 | Уязвимость расширения femanager системы управления контентом TYPO3, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-06007 | Уязвимость расширения Front End User Registration (sr_feuser_register) системы управления контентом TYPO3, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-06008 | Уязвимость расширения Download manager (reint_downloadmanager) системы управления контентом TYPO3, позволяющая нарушителю загружать произвольные файлы |
| BDU:2025-06734 | Уязвимость API-интерфейса программного средства для создания отчетов Cisco Unified Intelligence Center и программного средства для управления контакт-центрами Unified Contact Center Enterprise (Cisco Unified CCX), позволяющая нарушителю повысить свои... |
| BDU:2025-06822 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09771 | Уязвимость команды set-initial-sql аналитической платформы Tableau Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09793 | Уязвимость команды validate-initial-sql аналитической платформы Tableau Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09794 | Уязвимость интерфейса Tab-Doc API аналитической платформы Tableau Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-10193 | Уязвимость cистемы управления предприятием EvaProject (Carbon ERP), связанная с использованием небезопасной прямой ссылкой на объект (IDOR), позволяющая нарушителю получить доступ к защищаемой информации |
| BDU:2025-10638 | Уязвимость веб-панели управления многофункционального устройства (МФУ) Катюша М348, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-10982 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab EE/CE, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к данным пользоват... |
| BDU:2025-11316 | Уязвимость сценария ExportSettings.sh (/cgi-bin/ExportSettings.sh) микропрограммного обеспечения роутеров TOTOLINK EX200, позволяющая нарушителю обойти ограничения безопасности и получить несанкционированный доступ к защищаемой информации |
| BDU:2025-12643 | Уязвимость системы управления "Ассистент", связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-12658 | Уязвимость интерфейса администрирования инструмента аналитики и управления безопасностью Fortinet FortiPortal, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-13145 | Уязвимость системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI, связанная с обходом авторизации посредством ключа, позволяющая нарушителю получить несанкционированный доступ на изменение защищаемой информации |
| BDU:2025-13638 | Уязвимость функции service_finder_switch_back() плагина Service Finder Bookings системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-15285 | Уязвимость компонента GetPasswordExpirationDate интерфейса прикладного программирования Exchange Web Services, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-15734 | Уязвимость системы взаимодействия с клиентами IntraService, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2025-15862 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-16374 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-16491 | Уязвимость программного обеспечения для управления процессами подачи заявок Bidding Solutions, связанная с ошибкой обработки токенов LFS, позволяющая нарушителю получить несанкционированный доступ к учетным записям пользователям |
| BDU:2026-00759 | Уязвимость промышленных систем удаленного доступа mymbCONNECT24 и mbCONNECT24, VPN-портала myREX24 и виртуального сервера myREX24.virtual, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нар... |
| BDU:2026-00971 | Уязвимость механизма резервирования конфигурационных данных платформы виртуализации zVirt, позволяющая нарушителю получить несанкционированный доступ к конфигурационным данным |
| BDU:2026-00987 | Уязвимость программной платформы комплексного сетевого управления D-Link D-View, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить полный контроль над учетной записью и системой |
| BDU:2026-01728 | Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность и доступность защи... |
| BDU:2026-01729 | Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность и доступность защи... |
| BDU:2026-01730 | Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность и доступность защи... |
| BDU:2026-01731 | Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность и доступность защи... |
| BDU:2026-01732 | Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность и доступность защи... |
| BDU:2026-01945 | Уязвимость конечной точки /api-selfportal/get-info-token-properties программного комплекса Secure Authentication Server, позволяющая нарушителю провести атаку методом перебора и получить несанкционированный доступ к токенам пользователей |
| BDU:2026-03382 | Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказа... |
| BDU:2026-03580 | Уязвимость приложения Nextcloud calendar облачного программного обеспечения для создания и использования хранилища данных Nextcloud, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-04702 | Уязвимость пользовательского интерфейса Nginx UI сервера nginx, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой и... |
| BDU:2026-05092 | Уязвимость системы для ведения медицинской документации OpenEMR, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2026-05149 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации с помощью управляемого пользователем ключа, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-05296 | Уязвимость платформы для обмена файлами Flare, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на конфиденциальность защищаемой информации |
| BDU:2026-05297 | Уязвимость платформы для обмена файлами Flare, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-06413 | Уязвимость модуля отображения Blink браузера Google Chrome, позволяющая нарушителю выполнить подмену пользовательского интерфейса |
| BDU:2026-06982 | Уязвимость платформы для автоматизации рабочих процессов N8n, связанная с обходом авторизации с помощью управляемого пользователем ключа, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-07008 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаем... |
| BDU:2026-07013 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность защищаемой... |
| BDU:2026-07015 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность защищаемой... |
| BDU:2026-07016 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаем... |
| BDU:2026-07021 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность защищаемой... |
| BDU:2026-07132 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных |
| BDU:2026-07138 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователемI, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07139 | Уязвимость функции has_access_to_file() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных |
| BDU:2026-07141 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07142 | Уязвимость функции _validate_collection_access() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07451 | Уязвимость службы управления доступом Azure Privileged Identity Management (PIM) пакета для обеспечения совместимости Microsoft Azure Entra ID, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-07456 | Уязвимость функции update_message_by_id() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных |
| BDU:2026-07457 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07488 | Уязвимость механизма авторизации исполнителей рабочих процессов искусственного интеллекта Duo AI workflow runners программной платформы на базе git для совместной работы над кодом GitLab, позволяющая нарушителю оказать воздействие на конфиденциальнос... |
| BDU:2026-07548 | Уязвимость интерфейса Boards API (Focalboard) приложения для обмена мгновенными сообщениями Mattermost, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07583 | Уязвимость плагина moodle-mod_customcert виртуальной обучающей среды Moodle, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07772 | Уязвимость геоаналитической платформы с машинным обучением BestPlace, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и захватить уче... |
| BDU:2026-07784 | Уязвимость конечной точки /core/preview облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-09075 | Уязвимость программного интерфейса программной платформы на базе git для совместной работы над кодом GitLab EE, позволяющая нарушителю получить несанкционированный доступ на чтение и изменение защищаемой информации |
| BDU:2026-10240 | Уязвимость функции getParameter() класса AbstractSalesforceProcessor компонента camel-salesforce фреймворка Apache Camel, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-10659 | Уязвимость компонента Apache Camel JIRA java-фреймворка Apache Camel, позволяющая нарушителю получить несанкционированный доступ на чтение, изменение, добавление и удаление объектов |
| BDU:2026-10993 | Уязвимость функции get_flow_by_id_or_endpoint_name инструмента для создания и развёртывания агентов и рабочих процессов Langflow, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2026-11135 | Уязвимость файла dist/routes/oauth2/index.js программной платформы для создания пользовательских интерфейсов поверх языковых моделей (LLM) Flowise, позволяющая нарушителю осуществить SSRF-атаку и раскрыть защищаемую информацию |
Идентификаторы CVE уязвимостей
Идентификатор, базы данных общеизвестных уязвимостей информационной безопасности
| Идентификатор | Описание |
|---|---|
| CVE-2012-5571 | Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling |
| CVE-2016-20033 | Wowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm_x64.exe |
| CVE-2017-0882 | Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was i... |
| CVE-2017-0920 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in... |
| CVE-2017-0922 | Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsControlle... |
| CVE-2017-0936 | Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A m... |
| CVE-2017-20223 | Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference |
| CVE-2017-3183 | Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authentica... |
| CVE-2018-25129 | SOCA Access Control System 180612 Information Disclosure via Multiple Endpoints |
| CVE-2018-25270 | ThinkPHP 5.0.23 Remote Code Execution via invokefunction |
| CVE-2019-15581 | An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowe... |
| CVE-2019-15582 | An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) tha... |
| CVE-2019-25235 | Smartwares HOME easy 1.0.9 Client-Side Authentication Bypass via Web Pages |
| CVE-2019-25487 | SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmd |
| CVE-2019-5466 | An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names. |
| CVE-2019-5469 | An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to... |
| CVE-2020-16240 | GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerability allows user account... |
| CVE-2020-26068 | Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerability |
| CVE-2020-36895 | EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure |
| CVE-2020-36923 | Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR |
| CVE-2020-37008 | EasyPMS 1.0.0 - Authentication Bypass |
| CVE-2020-37094 | EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords |
| CVE-2020-8154 | An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of ot... |
| CVE-2020-8235 | Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all at... |
| CVE-2020-8297 | Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a d... |
| CVE-2021-21012 | Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure |
| CVE-2021-21022 | Magento Commerce Incorrect permissions Could Lead To Unauthorized Access |
| CVE-2021-21324 | Insecure Direct Object Reference (IDOR) on "Solutions" |
| CVE-2021-22951 | Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior... |
| CVE-2021-22967 | In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to... |
| CVE-2021-24374 | Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak |
| CVE-2021-24473 | User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR |
| CVE-2021-24562 | LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR |
| CVE-2021-24655 | WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise |
| CVE-2021-24739 | Logo Carousel < 3.4.2 - Unauthorised Private Post Access |
| CVE-2021-24800 | DW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDOR |
| CVE-2021-24840 | Squaretype Modern Blog < 3.0.4 - Unauthenticated Private/Schedule Posts Disclosure |
| CVE-2021-24892 | Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR |
| CVE-2021-25096 | IP2Location Country Blocker < 2.26.5 - Ban Bypass |
| CVE-2021-32654 | Attacker can obtain write access to any federated share/public link |
| CVE-2021-32744 | Unauthenticated attacker could gain access to currently open files |
| CVE-2021-36329 | Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malicious u... |
| CVE-2021-36801 | Akaunting Authentication Bypass in Company Selection |
| CVE-2021-37184 | A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could ch... |
| CVE-2021-37628 | File Drop can be bypassed using Richdocuments app in nextcloud |
| CVE-2021-37630 | Secret Circle can be joined without approval in Nextcloud Circles |
| CVE-2021-37631 | Circle can be accessed by non-Circle members in Nextcloud Deck |
| CVE-2021-3852 | Authorization Bypass Through User-Controlled Key in weseek/growi |
| CVE-2021-39225 | Missing permission check on Deck API |
| CVE-2021-3964 | Authorization Bypass Through User-Controlled Key in elgg/elgg |
| CVE-2021-40355 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.... |
| CVE-2021-41111 | Authorization Bypass Through User-Controlled Key in Rundeck |
| CVE-2021-41129 | Authentication bypass in Pterodactyl |
| CVE-2021-4142 | The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an atta... |
| CVE-2021-4226 | RSFirewall < 1.1.25 - IP Block Bypass |
| CVE-2021-43820 | Permissions check bypass in Seafile |
| CVE-2021-44160 | Carinal Tien Hospital Health Report System - Authorization Bypass Through User-Controlled Key |
| CVE-2021-47721 | Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation |
| CVE-2022-0266 | Authorization Bypass Through User-Controlled Key in livehelperchat/livehelperchat |
| CVE-2022-0442 | UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override |
| CVE-2022-0512 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-0613 | Authorization Bypass Through User-Controlled Key in medialize/uri.js |
| CVE-2022-0624 | Authorization Bypass Through User-Controlled Key in ionicabizau/parse-path |
| CVE-2022-0639 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-0686 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-0691 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-1165 | Blackhole for Bad Bots < 3.3.2 - Arbitrary IP Address Blocking via IP Spoofing |
| CVE-2022-1425 | WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR |
| CVE-2022-1579 | Login Block IPs <= 1.0.0 - IP Spoofing Bypass |
| CVE-2022-1580 | Site Offline < 1.5.3 - Access Bypass |
| CVE-2022-1581 | WP-Polls < 2.76.0 - IP Validation Bypass |
| CVE-2022-1600 | YOP Poll < 6.4.3 - IP Spoofing |
| CVE-2022-1613 | Restricted Site Access < 7.3.2 - Access Bypass via IP Spoofing |
| CVE-2022-1614 | WP-Email < 2.69.0 - Anti-Spam Protection Bypass via IP Spoofing |
| CVE-2022-1810 | Authorization Bypass Through User-Controlled Key in publify/publify |
| CVE-2022-1996 | Authorization Bypass Through User-Controlled Key in emicklei/go-restful |
| CVE-2022-2034 | Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API |
| CVE-2022-2080 | Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR |
| CVE-2022-2198 | WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR |
| CVE-2022-23061 | Shopizer - IDOR delete superadmin |
| CVE-2022-2312 | Student Result or Employee Database < 1.7.5 - Stored Cross Site Scripting via CSRF |
| CVE-2022-2367 | WSM Downloader <= 1.4.0 - Domain Name Restriction Bypass |
| CVE-2022-2535 | SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure |
| CVE-2022-2730 | Authorization Bypass Through User-Controlled Key in openemr/openemr |
| CVE-2022-2808 | IDOR in Prens Student Information System |
| CVE-2022-2824 | Authorization Bypass Through User-Controlled Key in openemr/openemr |
| CVE-2022-2877 | Titan Anti-spam & Security < 7.3.1 - Protection Bypass due to IP Spoofing |
| CVE-2022-2913 | Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass |
| CVE-2022-29159 | Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck |
| CVE-2022-31027 | Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator |
| CVE-2022-3282 | Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass |
| CVE-2022-3343 | WPQA < 5.9.3 - Missing validation lead to functionality abuse |
| CVE-2022-33944 | ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key |
| CVE-2022-34150 | ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key |
| CVE-2022-3459 | WooCommerce Multiple Free Gift <= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding |
| CVE-2022-3511 | Awesome Support < 6.1.2 - Subscriber+ Arbitrary Exported Tickets Download |
| CVE-2022-3589 | Miele: Vulnerability in cloud service used by appWash |
| CVE-2022-3794 | Jeg Elementor Kit <= 2.5.6 - Authorization Bypass |
| CVE-2022-3805 | Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass |
| CVE-2022-3846 | Workreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDOR |
| CVE-2022-3891 | WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access |
| CVE-2022-39018 | Broken access controls on PDFtron data in M-Files Hubshare |
| CVE-2022-3930 | Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR |
| CVE-2022-3995 | TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference |
| CVE-2022-4097 | All In One WP Security & Firewall < 5.0.8 - IP Spoofing |
| CVE-2022-4239 | Workreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR |
| CVE-2022-4340 | BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id |
| CVE-2022-43450 | WordPress Stream Plugin <= 3.9.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2022-4417 | WP Cerber < 9.3.3 - User Enumeration Bypass via Rest API |
| CVE-2022-4505 | Authorization Bypass Through User-Controlled Key in openemr/openemr |
| CVE-2022-46179 | LiuOS vulnerable to Authorization Bypass through User-Controlled Key |
| CVE-2022-4686 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4794 | AAWP < 3.12.3 - Unsafe URL Handling |
| CVE-2022-4798 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4799 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4802 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4803 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4806 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4811 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4812 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2023-0453 | WP Private Message < 1.0.6 - Private Message Disclosure via IDOR |
| CVE-2023-0550 | Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference |
| CVE-2023-0558 | ContentStudio <= 1.2.5 - Authorization Bypass |
| CVE-2023-0688 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcod... |
| CVE-2023-0689 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shor... |
| CVE-2023-0691 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortco... |
| CVE-2023-0692 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status'... |
| CVE-2023-0693 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id'... |
| CVE-2023-0694 | Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode |
| CVE-2023-0749 | Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure |
| CVE-2023-0772 | Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure |
| CVE-2023-0865 | WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR |
| CVE-2023-0882 | Authorization Bypass Through User-Controlled Key on Single Connect |
| CVE-2023-0985 | Helmholz and MB Connect Line: Account takeover via password reset in multiple products |
| CVE-2023-1125 | Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR |
| CVE-2023-1129 | WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR |
| CVE-2023-1462 | IDOR in Digikent |
| CVE-2023-1463 | Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampass |
| CVE-2023-1889 | Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_tas... |
| CVE-2023-1911 | Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access |
| CVE-2023-2065 | IDOR in Armoli Technology's Cargo Tracking System |
| CVE-2023-2172 | BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite |
| CVE-2023-2173 | BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion |
| CVE-2023-2190 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2023-22471 | Nextcloud Deck vulnerable to authorization bypass |
| CVE-2023-2260 | Authorization Bypass Through User-Controlled Key in alfio-event/alf.io |
| CVE-2023-2276 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Refe... |
| CVE-2023-23679 | WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (... |
| CVE-2023-24834 | WisdomGarden Tronclass ilearn - Broken Access Control |
| CVE-2023-24842 | HGiga MailSherlock - Broken Access Control |
| CVE-2023-25160 | IDOR Vulnerability in Nextcloud Mail |
| CVE-2023-2544 | Authorization Bypass on UPV PEIX |
| CVE-2023-2548 | RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change |
| CVE-2023-26428 | Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context.... |
| CVE-2023-2702 | IDOR in Finex Media's Competition Management System |
| CVE-2023-2713 | IDOR vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform. |
| CVE-2023-2751 | Upload Resume <= 1.2.0 - Captcha Bypass |
| CVE-2023-28109 | Play With Docker vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2023-2844 | Authorization Bypass Through User-Controlled Key in cloudexplorer-dev/cloudexplorer-lite |
| CVE-2023-28656 | NGINX Management Suite vulnerability |
| CVE-2023-2883 | IDOR in CBOT's Chatbot |
| CVE-2023-2958 | IDOR in ATS Pro |
| CVE-2023-2978 | Abstrium Pydio Cells Change Subscription authorization |
| CVE-2023-3048 | IDOR in TMT's Lockcell |
| CVE-2023-30550 | IDOR vulnerability exists in metersphere |
| CVE-2023-3063 | SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Passwo... |
| CVE-2023-30956 | IDOR in Foundry Comments allows retrieval of attachments |
| CVE-2023-30960 | Insecure Direct Object Reference (IDOR) in Foundry job-tracker |
| CVE-2023-3105 | LearnDash LMS <= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change |
| CVE-2023-31182 | EasyTor Applications – Authorization Bypass |
| CVE-2023-3133 | Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API |
| CVE-2023-32078 | Netmaker IDOR Vulnerability Allows User to Update Other User's Password |
| CVE-2023-3219 | EventON < 2.1.2 - Unauthenticated Post Access via IDOR |
| CVE-2023-32310 | DataEase API interface has IDOR vulnerability |
| CVE-2023-32669 | Authorization Bypass on BuddyBoss |
| CVE-2023-32747 | WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-32799 | WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-3285 | A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0 |
| CVE-2023-3286 | A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0 |
| CVE-2023-3287 | A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0 |
| CVE-2023-3288 | A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0 |
| CVE-2023-3289 | A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0 |
| CVE-2023-3290 | A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0 |
| CVE-2023-34000 | WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-35876 | WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-35914 | WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-35916 | WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-3601 | Simple Author Box < 2.52 - Contributor+ Arbitrary User Information Disclosure via IDOR |
| CVE-2023-36483 | MAS (a Carrier brand) MASmobile Classic Authorization Bypass |
| CVE-2023-36520 | WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-3700 | Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments |
| CVE-2023-3706 | ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure |
| CVE-2023-3707 | ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure |
| CVE-2023-37242 | Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerabilit... |
| CVE-2023-37871 | WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-38047 | A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments < 1.5.0. |
| CVE-2023-38048 | A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0 |
| CVE-2023-38049 | A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0 |
| CVE-2023-38050 | A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments < 1.5.0 |
| CVE-2023-38051 | A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments < 1.5.0 |
| CVE-2023-38052 | A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0 |
| CVE-2023-38053 | A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0 |
| CVE-2023-38054 | A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0 |
| CVE-2023-38055 | A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0 |
| CVE-2023-38201 | Keylime: challenge-response protocol bypass during agent registration |
| CVE-2023-38513 | WordPress Photo Engine Plugin <= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-3869 | wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease |
| CVE-2023-3998 | wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease |
| CVE-2023-40200 | WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability |
| CVE-2023-4023 | All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR |
| CVE-2023-4036 | Simple Blog Card < 1.32 - Subscriber+ Arbitrary Post Access |
| CVE-2023-40720 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0... |
| CVE-2023-4099 | Multiple vulnerabilities in IDM Sistemas QSige |
| CVE-2023-4101 | Multiple vulnerabilities in IDM Sistemas QSige |
| CVE-2023-41368 | Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps) |
| CVE-2023-41796 | WordPress Sunshine Photo Cart Plugin < 3.0.0 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-4213 | Simplr Registration Form Plus+ <= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Pass... |
| CVE-2023-42455 | Wazuh vulnerable to user privilege escalation |
| CVE-2023-43668 | Apache InLong: Jdbc Connection Security Bypass in InLong |
| CVE-2023-44154 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis... |
| CVE-2023-44205 | Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 15... |
| CVE-2023-44206 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis... |
| CVE-2023-44249 | An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before... |
| CVE-2023-44254 | An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 a... |
| CVE-2023-44981 | Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication |
| CVE-2023-45808 | iTop missing silo check on extkey in console and portal |
| CVE-2023-4587 | Insecure direct object reference in ZKTeco ZEM800 |
| CVE-2023-46311 | WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-46646 | Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository name... |
| CVE-2023-47191 | WordPress Youzify Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-47543 | An authorization bypass through user-controlled key vulnerability [CWE-639] in Fortinet FortiPortal version 7.0.0 through 7.0... |
| CVE-2023-48304 | Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user |
| CVE-2023-4836 | WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR |
| CVE-2023-48783 | An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, ve... |
| CVE-2023-49251 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of... |
| CVE-2023-4934 | IDOR in Usta AYBS |
| CVE-2023-49765 | WordPress Rate my Post – WP Rating System Plugin <= 3.4.1 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-49812 | WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-50267 | MeterSphere horizontal privilege escalation vulnerability of resources in project scope. |
| CVE-2023-51502 | WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-51503 | WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-53914 | UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability |
| CVE-2023-53930 | ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability |
| CVE-2023-53955 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References |
| CVE-2023-5922 | Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read |
| CVE-2023-6144 | Dev Blog v1.0 - ATO |
| CVE-2023-6223 | LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure |
| CVE-2023-6226 | WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure |
| CVE-2023-6317 | PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction |
| CVE-2023-6341 | Catalis CM360 allows authentication bypass |
| CVE-2023-6384 | WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR |
| CVE-2023-6504 | Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode |
| CVE-2023-6506 | WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending |
| CVE-2023-6515 | IDOR in Mia Technology's Mia-Med |
| CVE-2023-6523 | IDOR in ExtremePacs's Extreme XDS |
| CVE-2023-6724 | IDOR in Simgesel Software's Hearing Tracking System (Barosel) |
| CVE-2023-6824 | WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak |
| CVE-2023-6875 | POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass... |
| CVE-2023-6897 | EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode |
| CVE-2023-6929 | Authorization Bypass Through User-Controlled Key in EuroTel ETL3100 |
| CVE-2023-6969 | User Shortcodes Plus <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclo... |
| CVE-2023-6983 | Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Insecure Direct Object Reference to Authentic... |
| CVE-2023-7049 | Custom Field For WP Job Manager <= 1.2 - Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode |
| CVE-2023-7198 | WPDashboardNotes < 1.0.11 - Unauthorised Deletion of Private Notes |
| CVE-2023-7199 | Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure |
| CVE-2023-7239 | wp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR |
| CVE-2023-7252 | Tickera < 3.5.2.5 - Ticket leakage through IDOR |
| CVE-2023-7286 | ACF Quick Edit Fields <= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference |
| CVE-2024-0264 | SourceCodester Clinic Queuing System LoginRegistration.php authorization |
| CVE-2024-0421 | MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure |
| CVE-2024-0580 | Omission of key-controlled authorization in Qsige |
| CVE-2024-0839 | FeedWordPress <= 2022.0222 - Insecure Direct Object Referece |
| CVE-2024-0872 | Watu Quiz <= 3.4.1 - Sensitive Information Disclosure |
| CVE-2024-10075 | Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution |
| CVE-2024-10098 | ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access |
| CVE-2024-10121 | wfh45678 Radar Interface authorization |
| CVE-2024-10174 | WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure D... |
| CVE-2024-10215 | WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change |
| CVE-2024-10366 | IDOR in delete attachments in danny-avila/librechat |
| CVE-2024-10439 | Sunnet eHRD CTMS - Insecure Direct Object Reference |
| CVE-2024-10452 | Organization admins can delete pending invites created in an organization they are not part of. |
| CVE-2024-10497 | CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to mod... |
| CVE-2024-10654 | TOTOLINK LR350 formLoginAuth.htm authorization |
| CVE-2024-10666 | Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure |
| CVE-2024-10667 | Content Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Discl... |
| CVE-2024-10669 | Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10670 | Primary Addon for Elementor <= 1.6.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10671 | Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10688 | Attesa Extra <= 1.4.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10689 | XLTab – Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10690 | Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10692 | PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.8.1 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10693 | SKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10695 | Futurio Extra <= 2.0.13 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10696 | UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor S... |
| CVE-2024-1075 | Minimal Coming Soon – Coming Soon Page <= 2.37 - Unauthenticated Maintenance Mode Bypass |
| CVE-2024-10770 | Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10775 | Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10777 | AnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10778 | BuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10779 | Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10780 | Restaurant & Cafe Addon for Elementor <= 1.5.9 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10782 | Theme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10787 | LA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10794 | Boostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10795 | Popularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10796 | If-So Dynamic Content Personalization <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10797 | Full Screen Menu for Elementor <= 1.0.7 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10798 | Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10855 | Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Del... |
| CVE-2024-10868 | Enter Addons – Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10925 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-1107 | IDOR in Talya Informatics' Travel APPS |
| CVE-2024-11137 | IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary |
| CVE-2024-11146 | TrueFiling authorization bypass via user-controlled keys |
| CVE-2024-11167 | Improper Access Control in danny-avila/librechat |
| CVE-2024-11181 | Greenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-11216 | Broken Access Control in PozitifIK's Pik Online |
| CVE-2024-11275 | WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authen... |
| CVE-2024-11284 | WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover |
| CVE-2024-11285 | WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover |
| CVE-2024-11300 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-11318 | IDOR vulnerability in AbsysNet |
| CVE-2024-11915 | RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12046 | Medical Addon for Elementor <= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information... |
| CVE-2024-12059 | ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read |
| CVE-2024-12061 | Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12062 | Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12099 | Dollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12102 | Typer Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12103 | Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosure |
| CVE-2024-12114 | FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Referen... |
| CVE-2024-12116 | Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12131 | WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure... |
| CVE-2024-12132 | WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecur... |
| CVE-2024-12305 | Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform |
| CVE-2024-12306 | Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform |
| CVE-2024-12309 | Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts |
| CVE-2024-12335 | Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2024-12447 | Get Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Di... |
| CVE-2024-12472 | Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2024-12483 | Dromara UJCMS User ID id authorization |
| CVE-2024-12767 | BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR |
| CVE-2024-12812 | WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information |
| CVE-2024-1286 | Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure |
| CVE-2024-12880 | Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow |
| CVE-2024-1295 | The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Access |
| CVE-2024-13040 | Quanta Computer QOCA aim - Authorization Bypass |
| CVE-2024-13063 | IDOR in Akinsoft's MyRezzta |
| CVE-2024-1313 | Users outside an organization can delete a snapshot with its key |
| CVE-2024-13175 | IDOR in Vidco Software's VOC TESTER |
| CVE-2024-1330 | Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access |
| CVE-2024-13372 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download |
| CVE-2024-13407 | Omnipress <= 1.5.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-13425 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion |
| CVE-2024-13428 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion |
| CVE-2024-13429 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion |
| CVE-2024-13558 | NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Discl... |
| CVE-2024-13601 | Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direc... |
| CVE-2024-13607 | JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Referenc... |
| CVE-2024-13740 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscribe... |
| CVE-2024-13832 | Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure |
| CVE-2024-13841 | Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time <= 1.0.0 - Authenticated (Contributor+) Post Disc... |
| CVE-2024-13873 | WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection |
| CVE-2024-13887 | Business Directory Plugin - Easy Listing Directories for WordPress <= 6.4.14 - Insecure Direct Object Reference to Listing Ar... |
| CVE-2024-1470 | Elevation of Privilege attack on NetIQ Client login extension |
| CVE-2024-1604 | Incorrect authorization in BMC Control-M |
| CVE-2024-1625 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-1626 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-1640 | Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form <= 2.10.1 - Unauth... |
| CVE-2024-1693 | SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update |
| CVE-2024-1744 | IDOR in Ariva Computer's Accord ORS |
| CVE-2024-20513 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices co... |
| CVE-2024-21759 | An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 a... |
| CVE-2024-22206 | @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) |
| CVE-2024-22305 | WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object Referen... |
| CVE-2024-2231 | Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDOR |
| CVE-2024-22439 | Certain HPE FlexNetwork and FlexFabric Switches, Remote Authentication Bypass |
| CVE-2024-22455 | Dell Mobility - E-Lab Navigator, version(s) 3.1.9, 3.2.0, contain(s) an Authorization Bypass Through User-Controlled Key vuln... |
| CVE-2024-2261 | Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure |
| CVE-2024-23112 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 thr... |
| CVE-2024-2346 | FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference |
| CVE-2024-2441 | VikBooking < 1.6.8 - Insecure Direct Object References |
| CVE-2024-2472 | LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR |
| CVE-2024-2538 | Permalink Manager <= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification |
| CVE-2024-2543 | Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor |
| CVE-2024-2574 | SourceCodester Employee Task Management System edit-task.php authorization |
| CVE-2024-2575 | SourceCodester Employee Task Management System task-details.php authorization |
| CVE-2024-2576 | SourceCodester Employee Task Management System update-admin.php authorization |
| CVE-2024-2577 | SourceCodester Employee Task Management System update-employee.php authorization |
| CVE-2024-25983 | Msa-24-0006: idor on dashboard comments block |
| CVE-2024-27302 | Authorization Bypass Through User-Controlled Key in go-zero |
| CVE-2024-29020 | JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked |
| CVE-2024-29024 | JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality |
| CVE-2024-29181 | @strapi/plugin-content-manager leaks data via relations via the Admin Panel |
| CVE-2024-29194 | OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation |
| CVE-2024-3035 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-30507 | WordPress Molongui Authorship plugin <= 4.7.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-30513 | WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-30543 | WordPress Whizzy plugin <= 1.1.18 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-31095 | WordPress Thumbs Rating plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-31291 | WordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerability |
| CVE-2024-31296 | WordPress BookingPress plugin <= 1.0.81 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-31898 | IBM InfoSphere Information Server data modification |
| CVE-2024-32604 | WordPress WP-Recall plugin <= 16.26.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-32683 | WordPress WP Ultimate Review plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-32772 | WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-32808 | WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability |
| CVE-2024-32823 | WordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-3305 | IDOR in Utarit Information's SoliClub |
| CVE-2024-3306 | IDOR in Utarit Information's SoliClub |
| CVE-2024-33542 | WordPress Crelly Slider plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-34383 | WordPress SEOPress plugin <= 7.7.1 - Sensitive Data Exposure vulnerability |
| CVE-2024-34457 | Apache StreamPark IDOR Vulnerability |
| CVE-2024-35659 | WordPress KiviCare plugin <= 3.6.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-36399 | Kanboard affected by Project Takeover via IDOR in ProjectPermissionController |
| CVE-2024-37277 | WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-3748 | SP Project & Document Manager <= 4.71 - Data Update via IDOR |
| CVE-2024-3749 | SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR |
| CVE-2024-37889 | MyFinances Allows Unauthorized Access to Other Customer Data |
| CVE-2024-38701 | WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability |
| CVE-2024-38827 | Spring Security Authorization Bypass for Case Sensitive Comparisons |
| CVE-2024-39319 | aimeos/ai-controller-frontend has IDOR vulnerability in account profile page |
| CVE-2024-39321 | Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes |
| CVE-2024-39642 | WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-39897 | Cache driver GetBlob() allows read access to any blob without access control check |
| CVE-2024-39900 | OpenSearch Dashboards Reports does not properly restrict access to private tenant resources |
| CVE-2024-39901 | OpenSearch Observability does not properly restrict access to private tenant resources |
| CVE-2024-4151 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-4154 | Incorrect Synchronization in lunary-ai/lunary |
| CVE-2024-42169 | HCL MyXalytics is affected by insecure direct object references |
| CVE-2024-42422 | Dell NetWorker, version(s) 19.10, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability. An unauthenti... |
| CVE-2024-42463 | Leak of organizations messages |
| CVE-2024-42464 | Leak of user information |
| CVE-2024-4274 | Essential Real Estate <= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletion |
| CVE-2024-4279 | Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to A... |
| CVE-2024-43239 | WordPress Masteriyo LMS plugin <= 1.11.4 - Insecure Direct Object Reference (IDOR) vulnerability |
| CVE-2024-43266 | WordPress WP Job Portal plugin <= 2.1.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43288 | WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43315 | WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43322 | WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43916 | WordPress Zephyr Project Manager plugin <= 3.3.102 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-4464 | Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680,... |
| CVE-2024-45032 | A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Vir... |
| CVE-2024-45329 | A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and... |
| CVE-2024-4537 | IDOR vulnerability in Janto Ticketing Software |
| CVE-2024-4538 | IDOR vulnerability in Janto Ticketing Software |
| CVE-2024-45605 | Improper authorization on deletion of user issue alert notifications in sentry |
| CVE-2024-45606 | Improper authorization on muting of alert rules in sentry |
| CVE-2024-45614 | Header normalization allows for client to clobber proxy set headers in Puma |
| CVE-2024-4565 | Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access |
| CVE-2024-45786 | Improper Authorization Vulnerability |
| CVE-2024-45806 | Potential manipulate `x-envoy` headers from external sources in envoy |
| CVE-2024-4665 | EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update |
| CVE-2024-46982 | Cache Poisoning in next.js |
| CVE-2024-47316 | WordPress Salon Booking Wordpress Plugin plugin <= 10.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-47495 | Junos OS Evolved: In a dual-RE scenario a locally authenticated attacker with shell privileges can take over the device. |
| CVE-2024-4750 | BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment |
| CVE-2024-47657 | Improper Access Control Vulnerability |
| CVE-2024-4843 | ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a le... |
| CVE-2024-4873 | Replace Image <= 1.1.10 - Insecure Direct Object Reference |
| CVE-2024-4874 | Bricks Builder <= 1.9.8 - Insecure Direct Object Reference |
| CVE-2024-4886 | BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR |
| CVE-2024-49388 | Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect... |
| CVE-2024-50395 | Media Streaming add-on |
| CVE-2024-50483 | WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability |
| CVE-2024-5166 | Insecure Direct Object Reference In Looker |
| CVE-2024-52507 | Share information of the Nextcloud Tables app is not limited to affected users |
| CVE-2024-52511 | Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables |
| CVE-2024-5258 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-52601 | iTop portal Insecure Direct Object Reference vulnerability |
| CVE-2024-5438 | Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to A... |
| CVE-2024-5639 | User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update |
| CVE-2024-5942 | Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure |
| CVE-2024-5973 | MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor |
| CVE-2024-5977 | GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worke... |
| CVE-2024-6534 | Directus 10.13.0 - Insecure object reference via PATH presets |
| CVE-2024-6685 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-7473 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-7474 | IDOR in lunary-ai/lunary |
| CVE-2024-7476 | Broken Access Control in lunary-ai/lunary |
| CVE-2024-8123 | The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference |
| CVE-2024-8158 | User impersonation for lib9p based 9p fileservers |
| CVE-2024-43350 | WordPress Propovoice CRM plugin <= 1.7.6.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-4341 | IDOR in ExtremePacs's Extreme XDS |
| CVE-2024-5128 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-5130 | Incorrect Authorization in lunary-ai/lunary |
| CVE-2024-5131 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-51559 | Improper Access Control Vulnerability in Wave 2.0 |
| CVE-2024-52294 | khoj has an IDOR in subscription management that allows unauthorized subscription modifications |
| CVE-2024-52313 | data.all authenticated users can obtain incorrect object level authorizations |
| CVE-2024-5333 | The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure |
| CVE-2024-56143 | Strapi Allows Unauthorized Access to Private Fields via parms.lookup |
| CVE-2024-5619 | IDOR in PruvaSoft Informatics' Apinizer Management Console |
| CVE-2024-6087 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-6357 | Insecure Direct Object Reference vulnerability |
| CVE-2024-6410 | ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference |
| CVE-2024-7040 | Без описания... |
| CVE-2024-7041 | IDOR in open-webui/open-webui |
| CVE-2024-7848 | User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access |
| CVE-2024-8040 | Authorization Bypass Through User-Controlled Key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x |
| CVE-2024-8261 | IDOR in Proliz Software's OBS |
| CVE-2024-8290 | WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Obje... |
| CVE-2024-8292 | WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary... |
| CVE-2024-8428 | ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privileg... |
| CVE-2024-8485 | REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover |
| CVE-2024-8601 | Improper Access Control Vulnerability in TechExcel Back Office Software |
| CVE-2024-8613 | Improper Access Control in gaizhenbiao/chuanhuchatgpt |
| CVE-2024-8791 | Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Ref... |
| CVE-2024-8988 | PeepSo Core: File Uploads <= 6.4.6.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via... |
| CVE-2024-9097 | IDOR |
| CVE-2024-9215 | Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object R... |
| CVE-2024-9262 | User Meta – User Profile Builder and User management plugin <= 3.1.1 - Insecure Direct Object Reference to Sensitive Informat... |
| CVE-2024-9263 | WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Referenc... |
| CVE-2024-9554 | Sovell Smart Canteen System Password Reset suanfa.py Check_ET_CheckPwdz201 authorization |
| CVE-2025-0606 | IDOR in Logo Software's Logo Cloud |
| CVE-2025-0875 | IDOR in Proliz Software's OBS |
| CVE-2025-0987 | IDOR in CB Project's CVLand |
| CVE-2025-10005 | Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protect... |
| CVE-2024-9617 | IDOR in danswer-ai/danswer |
| CVE-2024-9637 | School Management System – WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Tak... |
| CVE-2024-9687 | WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass |
| CVE-2024-9700 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submissio... |
| CVE-2024-9819 | IDOR in NextGEO's NG Analyser |
| CVE-2024-9862 | Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change |
| CVE-2025-0337 | Authorization bypass in Now Platform |
| CVE-2025-0352 | Rapid Response Monitoring My Security Account App Authorization Bypass Through User-Controlled Key |
| CVE-2025-0640 | IDOR in Akinsoft's OctoCloud |
| CVE-2025-0642 | Hard-coded Credentials in PosCube's Assist |
| CVE-2025-0661 | DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2025-0670 | IDOR in Akinsoft's ProKuafor |
| CVE-2025-1031 | IDOR in Utarit Informatics' SoliClub |
| CVE-2025-10019 | WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-10024 | IDOR in EXERT Computer Technologies' Education Management System |
| CVE-2025-10039 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference v... |
| CVE-2025-11127 | Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation |
| CVE-2025-11176 | Quick Featured Images <= 13.7.2 - Insecure Direct Object Reference to Image Manipulation |
| CVE-2025-11517 | Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass |
| CVE-2025-11518 | WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation |
| CVE-2025-11519 | Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload |
| CVE-2025-11532 | Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation |
| CVE-2025-12071 | Frontend User Notes <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification |
| CVE-2025-12086 | Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund... |
| CVE-2025-10493 | Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie |
| CVE-2025-10570 | Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary O... |
| CVE-2025-10719 | WisdomGarden｜Tronclass - Insecure Direct Object Reference |
| CVE-2025-10720 | WP Private Content Plus <= 3.6.2 - Password Protection Bypass |
| CVE-2025-10742 | Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change |
| CVE-2025-10759 | Webkul QloApps CSRF Token authorization |
| CVE-2025-10855 | IDOR in Solvera Software's Teknoera |
| CVE-2025-10910 | Gaining remote control over Govee devices |
| CVE-2025-10912 | IDOR in saastech.io's TemizlikYolda |
| CVE-2025-10947 | Sistemas Pleno Gestão de Locação CPF validarCpf authorization |
| CVE-2025-11247 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-11321 | zhuimengshaonian wisdom-education WrongBookController.java authorization |
| CVE-2025-11690 | IDOR vulnerability in the CFMOTO RIDE API |
| CVE-2025-11895 | Binary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference |
| CVE-2025-11924 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Se... |
| CVE-2025-12087 | Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishl... |
| CVE-2025-11957 | Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated... |
| CVE-2025-12008 | IDOR in APPYAP's Yaay Social Media App |
| CVE-2025-12030 | ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification |
| CVE-2025-12040 | Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation |
| CVE-2025-12063 | An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appr... |
| CVE-2025-12623 | fushengqian fuint Authentication Token ClientSignController.java authorization |
| CVE-2025-1270 | Insecure direct object reference (IDOR) vulnerability in H6Web |
| CVE-2025-12766 | Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of affected versions of BlackBerry AtHoc. |
| CVE-2025-12833 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authentic... |
| CVE-2025-1284 | Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference t... |
| CVE-2025-12854 | newbee-mall-plus seckillExecution executeSeckill authorization |
| CVE-2025-12881 | Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitra... |
| CVE-2025-12883 | Campay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment Bypass |
| CVE-2025-0058 | Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow |
| CVE-2025-11741 | WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure |
| CVE-2025-11748 | Groups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join |
| CVE-2025-12283 | code-projects Client Details System authorization |
| CVE-2025-12288 | Bdtask Pharmacy Management System User Profile edit_user authorization |
| CVE-2025-12351 | Inadequate access control measure allows unauthorized users to access restricted administrative functions |
| CVE-2025-12353 | WPFunnels <= 3.6.2 - Unauthorized User Registration |
| CVE-2025-12366 | Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference |
| CVE-2025-12427 | YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename |
| CVE-2025-12524 | Post Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change |
| CVE-2025-12954 | Timetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR |
| CVE-2025-12997 | Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with acce... |
| CVE-2025-13003 | IDOR in Aksis Computer's AxOnboard |
| CVE-2025-12126 | The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation |
| CVE-2025-12903 | Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud |
| CVE-2025-13109 | HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Referenc... |
| CVE-2025-13110 | HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Referenc... |
| CVE-2025-13124 | IDOR in Netiket''s ApplyLogic |
| CVE-2025-13125 | IDOR in Im Park's DijiDemi |
| CVE-2025-13157 | QODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update |
| CVE-2025-13452 | Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Imp... |
| CVE-2025-13457 | WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token... |
| CVE-2025-13471 | User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update |
| CVE-2025-13474 | IDOR in Menulux Software's Mobile App |
| CVE-2025-13479 | IDOR in PosCube's QR Menu |
| CVE-2025-13748 | Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id |
| CVE-2025-13768 | Uniong｜WebITR - Authorization Bypass |
| CVE-2025-13932 | The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR... |
| CVE-2025-15096 | Videospirecore Theme Plugin <= 1.0.6 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeove... |
| CVE-2025-15147 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update... |
| CVE-2025-15582 | detronetdip E-commerce Product Management Update authorization |
| CVE-2025-14033 | ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure |
| CVE-2025-14073 | WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure |
| CVE-2025-14101 | IDOR in GG Soft's PaperWork |
| CVE-2025-14594 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-1469 | IDOR in Turtek Software's Eyotek |
| CVE-2025-14881 | Insecure direct object reference |
| CVE-2025-14882 | Insecure direct object reference |
| CVE-2025-14974 | IBM InfoSphere Information Server is vulnerable due to Insecure Direct Object Reference |
| CVE-2025-14996 | AS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-14998 | Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Take... |
| CVE-2025-15001 | FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-15018 | Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover |
| CVE-2025-15025 | IDOR in Yordam Informatics' Library Automation System |
| CVE-2025-15033 | WooCommerce - Subscriber/Customer+ Order Data Disclosure |
| CVE-2025-15521 | Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Accoun... |
| CVE-2025-15626 | Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application |
| CVE-2025-15657 | WordPress School Management plugin <= 93.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-2301 | IDOR in Akbim Software's Online Exam Registration |
| CVE-2025-24969 | iTop portal user can see any other contact's picture |
| CVE-2025-13382 | Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renamin... |
| CVE-2025-13389 | Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Informat... |
| CVE-2025-14356 | Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission... |
| CVE-2025-14459 | Virt-cdi-controller: unauthorized pvc cloning via dataimportcron |
| CVE-2025-14742 | WP Recipe Maker <= 10.2.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure |
| CVE-2025-14772 | Broken Access Control in ABB T-MAC Plus web application |
| CVE-2025-14802 | LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Materi... |
| CVE-2025-14844 | Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Inf... |
| CVE-2025-15370 | Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator |
| CVE-2025-1607 | SourceCodester Best Employee Management System salary_slip.php authorization |
| CVE-2025-20214 | A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticat... |
| CVE-2025-22695 | WordPress Nirweb support plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2025-2271 | IDOR in Issuetrak NewAuditID parameter via Inv_PopTrakXShow.asp |
| CVE-2025-24487 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-24850 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-13004 | IDOR in Farktor Software's E-Commerce Package |
| CVE-2025-1327 | Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitr... |
| CVE-2025-13615 | StreamTube Core <= 4.78 - Unauthenticated Arbitrary User Password Change |
| CVE-2025-13822 | Authentication bypass in MCPHub |
| CVE-2025-13842 | Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure |
| CVE-2025-13874 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-24315 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-26660 | Broken Access Control in SAP Fiori apps (Posting Library) |
| CVE-2025-26965 | WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-26977 | WordPress FileBird plugin <= 6.4.2.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-27433 | Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) |
| CVE-2025-27436 | Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) |
| CVE-2025-27565 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27568 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27575 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-26788 | StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction. |
| CVE-2025-26857 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27507 | IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations |
| CVE-2025-27561 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27927 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27929 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27938 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27939 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-30254 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-30257 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-30777 | WordPress Support Genix plugin <= 1.4.11 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-3091 | MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24 |
| CVE-2025-31357 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31360 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31833 | WordPress JobBoard Job listing plugin Plugin <= 1.2.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-31867 | WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-31933 | Growatt Cloud Applications Authorization Bypass Through User-Controlled Key |
| CVE-2025-31941 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31945 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31949 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-3282 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Ref... |
| CVE-2025-3292 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Ref... |
| CVE-2025-3519 | Replace uploaded files knowing the file upload ID |
| CVE-2025-36023 | IBM Cloud Pak for Business Automation security bypass |
| CVE-2025-1667 | School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover |
| CVE-2025-20114 | Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability |
| CVE-2025-22608 | Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) |
| CVE-2025-2526 | Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover |
| CVE-2025-25276 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-25282 | Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow |
| CVE-2025-2563 | User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation |
| CVE-2025-2594 | User Registration & Membership < 4.1.3 - Authentication Bypass |
| CVE-2025-28874 | WordPress BP Email Assign Templates By shanebp plugin <= 1.7 - Arbitrary Content Deletion vulnerability |
| CVE-2025-30514 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-3089 | Broken Access Control in ServiceNow AI Platform |
| CVE-2025-31147 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31654 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31950 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31997 | HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2025-32373 | DNN allows a registered user to enumerate and access files they should not have access to |
| CVE-2025-32781 | Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId |
| CVE-2025-3281 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Ref... |
| CVE-2025-34293 | GN4 Publishing System Insecure Direct Object Reference (IDOR) Information Disclosure |
| CVE-2025-34435 | AVideo < 20.1 IDOR Arbitrary File Deletion |
| CVE-2025-34436 | AVideo < 20.1 IDOR Arbitrary File Upload |
| CVE-2025-34437 | AVideo < 20.1 IDOR Arbitrary Comment Image Upload |
| CVE-2025-34438 | AVideo < 20.1 IDOR Arbitrary Video Rotation |
| CVE-2025-3769 | Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference |
| CVE-2025-3810 | WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-3811 | WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update |
| CVE-2025-27719 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-32223 | WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-34140 | ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix |
| CVE-2025-3574 | Insecure Direct Object Reference on Deporsite by T-INNOVA |
| CVE-2025-3575 | Insecure Direct Object Reference en Deporsite de T-INNOVA |
| CVE-2025-3636 | Moodle: idor in moodle rss block allows unauthorized access to rss feeds |
| CVE-2025-36365 | IBM Db2 Privilege Escalation |
| CVE-2025-3640 | Moodle: idor in web service allows users enrolled in a course to access some details of other users |
| CVE-2025-3853 | WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Gene... |
| CVE-2025-3874 | WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference |
| CVE-2025-3889 | WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity' |
| CVE-2025-40650 | Insecure Direct Object Reference (IDOR) in Clickedu |
| CVE-2025-40658 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40659 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-3605 | Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-3610 | Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update |
| CVE-2025-3625 | Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action |
| CVE-2025-39434 | WordPress Avatar plugin <= 0.1.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-4040 | IDOR in Turpak's Automatic Station Monitoring System |
| CVE-2025-41020 | Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito |
| CVE-2025-41069 | Insecure Direct Object References (IDOR) in DeporSite of T-Innova DeporSite |
| CVE-2025-41077 | Multiple vulnerabilities in Viafirma products |
| CVE-2025-41086 | Authorization bypass in GAMS from GAMS Development Corp. |
| CVE-2025-41091 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41092 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41093 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41094 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41095 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41096 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41097 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-39537 | WordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability |
| CVE-2025-40773 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broke... |
| CVE-2025-40805 | Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthentica... |
| CVE-2025-4129 | IDOR in PAVO Inc.'s PAVO Pay |
| CVE-2025-41358 | Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A |
| CVE-2025-42605 | Improper Access Control Vulnerability in Meon Bidding Solutions |
| CVE-2025-43724 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability... |
| CVE-2025-43732 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1... |
| CVE-2025-46386 | CWE-639 Authorization Bypass Through User-Controlled Key |
| CVE-2025-46387 | CWE-639 Authorization Bypass Through User-Controlled Key |
| CVE-2025-47555 | WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-49135 | CVAT missing validation for in-progress backup upload names |
| CVE-2025-49952 | WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-49978 | WordPress JobSearch plugin < 3.0.6 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-49995 | WordPress Download Attachments plugin <= 1.3.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-53208 | WordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-41098 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41099 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-4596 | Information disclosure via IDOR in Asseco AMDX |
| CVE-2025-4691 | Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to... |
| CVE-2025-4796 | Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover |
| CVE-2025-4855 | Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key |
| CVE-2025-49334 | WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-49352 | WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerabil... |
| CVE-2025-5182 | Summer Pearl Group Vacation Rental Management Platform Listing authorization |
| CVE-2025-5195 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-52446 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api mo... |
| CVE-2025-52447 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sq... |
| CVE-2025-52448 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initi... |
| CVE-2025-5518 | IDOR in ArgusTech's BILGER |
| CVE-2025-5526 | BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update |
| CVE-2025-57886 | WordPress Accessibility Checker by Equalize Digital Plugin <= 1.30.0 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-53640 | Indico vulnerable to user enumeration via API endpoint |
| CVE-2025-55737 | flaskBlog arbitrary comment delete |
| CVE-2025-5681 | IDOR in Turtek Software's Eyotek |
| CVE-2025-57994 | WordPress Upcoming Events Lists Plugin <= 1.4.0 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-58012 | WordPress Content Mask plugin <= 1.8.5.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-58055 | Discourse AI Suggestions Contain Insecure Direct Object Reference |
| CVE-2025-58402 | Insecure Direct Object Reference Message ID |
| CVE-2025-59034 | Indico may disclose unauthorized user details access via legacy API |
| CVE-2025-6038 | Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privi... |
| CVE-2025-61950 | In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly... |
| CVE-2025-62241 | Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allo... |
| CVE-2025-62242 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and... |
| CVE-2025-62244 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay... |
| CVE-2025-62252 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versio... |
| CVE-2025-63043 | WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-63053 | WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-63065 | WordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerability |
| CVE-2025-6329 | ScriptAndTools Real Estate Management System User Delete userdelete.php authorization |
| CVE-2025-64497 | Tuleap exposes releases for all projects to File Release System project administrators |
| CVE-2025-64516 | GLPI incorrectly authorizes access to documents |
| CVE-2025-64523 | FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function |
| CVE-2025-65020 | Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR) |
| CVE-2025-65021 | Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR) |
| CVE-2025-65028 | Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes |
| CVE-2025-65029 | Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants |
| CVE-2025-65030 | Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal |
| CVE-2025-65031 | Rallly Improper Authorization in Comment Endpoint Allows User Impersonation |
| CVE-2025-65032 | Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names |
| CVE-2025-65033 | Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation |
| CVE-2025-65034 | Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId |
| CVE-2025-65096 | RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections |
| CVE-2025-65097 | Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections |
| CVE-2025-65098 | Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass |
| CVE-2025-66513 | Nextcloud Tables app share information not limited to relevant users |
| CVE-2025-66546 | Nextcloud Calendar app allowed booking appointments without the generated token |
| CVE-2025-66547 | Nextcloud Server users can modify tags on files that do not belong to them |
| CVE-2025-66551 | Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users |
| CVE-2025-66553 | Nextcloud Tables app allowed users to view columns metadata information of any table |
| CVE-2025-66556 | Nextcloud talk allows participants to blindly delete poll drafts of other users by ID |
| CVE-2025-68044 | WordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68051 | WordPress Shiprocket plugin <= 2.0.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68071 | WordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68492 | Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerabi... |
| CVE-2025-68502 | WordPress JetPopup plugin <= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68514 | WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69029 | WordPress Struktur theme <= 2.5.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69030 | WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69032 | WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69202 | axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header |
| CVE-2025-69347 | WordPress WPSubscription plugin <= 1.8.10 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-58137 | Apache Fineract: IDOR via self-service API |
| CVE-2025-58597 | WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-58627 | WordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-59133 | WordPress Projectopia plugin <= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-5947 | Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie |
| CVE-2025-5948 | Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business |
| CVE-2025-5949 | Service Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password |
| CVE-2025-59562 | WordPress Academy LMS Plugin <= 3.3.4 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-61779 | Trustee's attestation-policy endpoint is not protected by admin autentication |
| CVE-2025-62166 | FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens |
| CVE-2025-62180 | Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated u... |
| CVE-2025-62893 | Без описания... |
| CVE-2025-64105 | FOSSBilling: IDOR Vulnerability in Support Ticket Creation |
| CVE-2025-64282 | WordPress Radius Blocks plugin <= 2.2.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-64283 | WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-64431 | IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering |
| CVE-2025-64706 | Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure |
| CVE-2025-6574 | Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover |
| CVE-2025-66123 | WordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-66132 | WordPress FAPI Member plugin <= 2.2.30 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-66286 | Webkitgtk: authorization bypass through webpage::send-request signal handler |
| CVE-2025-66306 | Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel |
| CVE-2025-66558 | Nextcloud Twofactor WebAuthn app was updated based on public key |
| CVE-2025-67594 | WordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-67909 | WordPress Membership For WooCommerce plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-67919 | WordPress Woffice Core plugin <= 5.4.30 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-67985 | WordPress Document Library Lite plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-6833 | All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authen... |
| CVE-2025-68975 | WordPress Eagle Booking plugin <= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68979 | WordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68997 | WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69207 | Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning |
| CVE-2025-69274 | Spectrum broken authorization scheme |
| CVE-2025-7013 | IDOR in QRMenumPro's Menu Panel |
| CVE-2025-7049 | WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover |
| CVE-2025-7347 | IDOR in Dinibh Puzzle's Dinibh Patrol Tracking System |
| CVE-2025-7355 | IDOR in Beefull Energy Technologies' Beefull App |
| CVE-2025-8057 | IDOR in Patika Global Technologies' HumanSuite |
| CVE-2025-8532 | IDOR in Bimser's eBA Document and Workflow Management System |
| CVE-2025-8770 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-8789 | Portabilis i-Educar API Endpoint Diario authorization |
| CVE-2025-8794 | LitmusChaos Litmus LocalStorage authorization |
| CVE-2025-9062 | IDOR in MeCODE Informatics' Envanty |
| CVE-2025-9081 | IDOR in board file download allows any user to download any file by UUID |
| CVE-2025-9520 | IDOR Leading to Owner Account Hijacking in Omada Controller |
| CVE-2025-9559 | Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface... |
| CVE-2026-0909 | WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Paramet... |
| CVE-2025-69394 | WordPress Cnvrse plugin < 026.02.10.20 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-6942 | The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an... |
| CVE-2025-71388 | stoatchat 20241213-1 Webhook Token Disclosure via Read Permissions |
| CVE-2025-71400 | better-auth passkey before 1.4.0 IDOR via delete-passkey |
| CVE-2025-7718 | Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Refere... |
| CVE-2025-7733 | WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference |
| CVE-2025-7899 | Insecure Direct Object Reference in extension "powermail" (powermail) |
| CVE-2025-7900 | Insecure Direct Object Reference in extension "femanager" (femanager) |
| CVE-2025-7938 | jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java updateGoods authorization |
| CVE-2025-8447 | Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access |
| CVE-2025-8463 | IDOR in SecHard Information Technologies' SecHard |
| CVE-2025-8755 | macrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorization |
| CVE-2025-8855 | 2FA Expiry Bypass in Optimus Software's Brokerage Automation |
| CVE-2025-8884 | IDOR in VHS Electronic Software's ACE Center |
| CVE-2025-8887 | IDOR in Usta Information Systems' Aybs Interaktif |
| CVE-2025-9114 | Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change |
| CVE-2025-9342 | IDOR in Anadolu Hayat Emeklilik's AHE Mobile |
| CVE-2025-9835 | macrozheng mall cancelUserOrder cancelOrder authorization |
| CVE-2025-9836 | macrozheng mall paySuccess authorization |
| CVE-2025-9902 | IDOR in Akınsoft QRMenu |
| CVE-2026-10096 | Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' P... |
| CVE-2026-10103 | Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels |
| CVE-2026-10140 | Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem |
| CVE-2026-10154 | Dolibarr ERP CRM messaging.php authorization |
| CVE-2026-10212 | AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization |
| CVE-2026-10623 | PressPrimer Quiz <= 2.3.0 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id',... |
| CVE-2026-10630 | WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via '... |
| CVE-2026-10700 | Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files |
| CVE-2026-11369 | IDOR in Comment API Allows Cross-Process Comment Read and Write |
| CVE-2026-11454 | Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference |
| CVE-2026-11461 | NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization |
| CVE-2026-11578 | Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR |
| CVE-2026-11580 | Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR |
| CVE-2026-11763 | IDOR in GIS Informatics' GisLab Laboratory Management System |
| CVE-2026-11987 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object... |
| CVE-2026-11988 | LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via... |
| CVE-2026-1201 | Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs |
| CVE-2026-1206 | Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure... |
| CVE-2026-12073 | ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite |
| CVE-2026-12102 | UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_... |
| CVE-2026-1213 | Askbot 0.12.2 - Insecure Direct Object Reference (IDOR) |
| CVE-2026-1228 | Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode... |
| CVE-2026-12376 | Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint |
| CVE-2026-12393 | WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR |
| CVE-2026-12397 | WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDOR |
| CVE-2026-12400 | FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST AP... |
| CVE-2026-12411 | Broken Access Control in Canonical LXD DevLXD API |
| CVE-2026-12418 | User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direc... |
| CVE-2026-12433 | Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'book... |
| CVE-2026-1251 | SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Refere... |
| CVE-2026-12510 | AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR |
| CVE-2026-12657 | LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter |
| CVE-2026-13169 | Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR |
| CVE-2026-13175 | Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR |
| CVE-2026-13177 | Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR |
| CVE-2026-13178 | Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation |
| CVE-2026-13345 | Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Tab... |
| CVE-2026-13350 | Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be all... |
| CVE-2026-13358 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecu... |
| CVE-2026-1338 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-13381 | VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion |
| CVE-2026-13399 | Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order |
| CVE-2026-13404 | Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init |
| CVE-2026-13445 | Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple una... |
| CVE-2026-13450 | GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parame... |
| CVE-2026-13464 | Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Paramete... |
| CVE-2026-13490 | glpi-project glpi Document document.send.php canViewFile authorization |
| CVE-2026-13512 | Databend Tenant client_session_manager.rs state_key authorization |
| CVE-2026-13534 | CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization |
| CVE-2026-13549 | CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization |
| CVE-2026-13612 | KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR |
| CVE-2026-1375 | Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deleti... |
| CVE-2026-1389 | Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Del... |
| CVE-2026-14310 | Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection |
| CVE-2026-14313 | PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR |
| CVE-2026-14314 | PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR |
| CVE-2026-1436 | Improper Access Control (IDOR) vulnerability in Graylog Web Interface |
| CVE-2026-14608 | SourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view_student authorization |
| CVE-2026-14614 | Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource |
| CVE-2026-14753 | mjperpinosa stumasy Note Handler/Assignment notes authorization |
| CVE-2026-14927 | FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes |
| CVE-2026-14938 | FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR |
| CVE-2026-1496 | Coverity CLI Authentication Bypass |
| CVE-2026-15036 | Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization |
| CVE-2026-15058 | Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenti... |
| CVE-2026-15389 | Inadequate access control in Sesame Time session management |
| CVE-2026-1541 | Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Refe... |
| CVE-2026-15516 | MacCMS Pro Installation Index.php step5 authorization |
| CVE-2026-1558 | WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'rec... |
| CVE-2026-15622 | poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization |
| CVE-2026-15637 | Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 all... |
| CVE-2026-15909 | RafyMrX TOKO-ONLINE-ROTI add.php authorization |
| CVE-2026-15945 | Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 |
| CVE-2026-16039 | MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR |
| CVE-2026-16058 | YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration |
| CVE-2026-16070 | Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR |
| CVE-2026-16075 | AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization |
| CVE-2026-16142 | TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parame... |
| CVE-2026-1619 | IDOR in Universal Sotware's FlexCity/Kiosk |
| CVE-2026-16214 | geex-arts django-jet Dashboard views.py authorization |
| CVE-2026-16217 | guohongze adminset Delivery Deployment Endpoint deli.py authorization |
| CVE-2026-16291 | ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR |
| CVE-2026-16309 | IDOR in Netiket Information Technologies' EdoWEB |
| CVE-2026-16450 | zsadmin2025 ZS-Admin MyBatis-Plus Tenant Plugin page getTenantId authorization |
| CVE-2026-16564 | Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint |
| CVE-2026-16565 | Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API |
| CVE-2026-16567 | Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle |
| CVE-2026-16568 | ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR |
| CVE-2026-16574 | Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint |
| CVE-2026-1664 | Insecure Direct Object Reference (IDOR) via Header-Based Email Routing |
| CVE-2026-16737 | WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart |
| CVE-2026-16746 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint |
| CVE-2026-16797 | ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'op... |
| CVE-2026-16953 | AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie |
| CVE-2026-16957 | Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure |
| CVE-2026-16979 | SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration |
| CVE-2026-17349 | pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner |
| CVE-2026-17527 | Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/sour... |
| CVE-2026-1753 | Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update |
| CVE-2026-17531 | unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization |
| CVE-2026-17562 | IDOR in Zirve Security's AdisyonPro |
| CVE-2026-17567 | Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transact... |
| CVE-2026-17570 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged us... |
| CVE-2026-18028 | Missing authorization check in event quick setup view |
| CVE-2026-18200 | FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update |
| CVE-2026-18258 | Authorization Bypass Through User-Controlled Key in eScriptorium |
| CVE-2026-18275 | Authorization Bypass Through User-Controlled Key in eScriptorium |
| CVE-2026-18315 | TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_... |
| CVE-2026-18722 | diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization |
| CVE-2026-1881 | Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta |
| CVE-2026-19064 | SourceCodester Online Examination & Learning Management System view.php authorization |
| CVE-2026-19066 | SourceCodester Online Examination & Learning Management System view_students.php authorization |
| CVE-2026-19077 | Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization |
| CVE-2026-19085 | Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure |
| CVE-2026-19111 | Insecure direct object reference in Strands Agents Tools memory tool namespace isolation |
| CVE-2026-19130 | Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlle... |
| CVE-2026-19228 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-19294 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulner... |
| CVE-2026-19416 | KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR |
| CVE-2026-19417 | KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR |
| CVE-2026-19734 | IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking |
| CVE-2026-19784 | francoisjacquet RosarioSIS Referrals.php DBUpdate authorization |
| CVE-2026-19834 | Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization |
| CVE-2026-19836 | Webkul Bagisto Backend Customer Detail Feature view authorization |
| CVE-2026-19838 | Webkul Bagisto Backend Reporting Endpoint sales authorization |
| CVE-2025-40660 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40661 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40676 | Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC |
| CVE-2025-4210 | Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization |
| CVE-2025-43782 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 th... |
| CVE-2025-43790 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 th... |
| CVE-2025-43803 | Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119... |
| CVE-2025-43810 | Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, an... |
| CVE-2025-43827 | Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older... |
| CVE-2025-5261 | IDOR in PozitifIK's Pik Online |
| CVE-2025-53357 | GLPI permits reservation modification by unauthorized users |
| CVE-2025-54691 | WordPress Motors Plugin plugin <= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2026-16981 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR |
| CVE-2026-17018 | CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR |
| CVE-2026-17020 | Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure |
| CVE-2026-1704 | Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information E... |
| CVE-2026-17059 | Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter |
| CVE-2026-18620 | Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy |
| CVE-2026-18631 | jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization |
| CVE-2026-18818 | Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization |
| CVE-2026-1883 | Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion |
| CVE-2026-18904 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulner... |
| CVE-2026-18945 | WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation |
| CVE-2026-18962 | WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization |
| CVE-2026-19424 | Inventec Appliances｜Chiline Cloud - Insecure Direct Object Reference |
| CVE-2026-19433 | Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export |
| CVE-2026-1947 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modi... |
| CVE-2026-19579 | Snipe-IT Checkout Request Cancellation IDOR |
| CVE-2026-20219 | A vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote attacker to access the social prof... |
| CVE-2026-2028 | Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter |
| CVE-2026-21409 | Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted... |
| CVE-2026-22104 | Improper access control in Hashtopolis server chunk activity component |
| CVE-2026-22234 | OPEXUS eCasePortal unauthenticated IDOR |
| CVE-2026-22235 | OPEXUS eComplaint IDOR |
| CVE-2026-2230 | Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modifi... |
| CVE-2026-22383 | WordPress PawFriends - Pet Shop and Veterinary WordPress theme theme <= 1.3 - Insecure Direct Object References (IDOR) vulner... |
| CVE-2026-22391 | WordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22393 | WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22396 | WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22398 | WordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22400 | WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22404 | WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-10023 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (... |
| CVE-2026-10038 | Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'a... |
| CVE-2026-10041 | WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Dat... |
| CVE-2026-10597 | ITPison｜OMICARD EDM - Insecure Direct Object Reference |
| CVE-2026-10599 | Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse |
| CVE-2026-10780 | Static Block <= 2.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via S... |
| CVE-2026-1080 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-10820 | ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR |
| CVE-2026-11500 | Weaviate Static API Key client.go validateConfig authorization |
| CVE-2026-11875 | WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery |
| CVE-2026-11880 | Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR |
| CVE-2026-11889 | SALTO ProAccess Space Authorization Bypass Through User-Controlled Key |
| CVE-2026-11896 | My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Param... |
| CVE-2026-11900 | Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure vi... |
| CVE-2026-11963 | User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR |
| CVE-2026-11966 | User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler |
| CVE-2026-1219 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Referen... |
| CVE-2026-12204 | ShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorization |
| CVE-2026-12271 | Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR |
| CVE-2026-12274 | Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR |
| CVE-2026-12686 | Incorrect authorisation in Adiss’s Biloop |
| CVE-2026-12693 | IDOR in Vimesoft's Enterprise Video Platform |
| CVE-2026-12697 | wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR |
| CVE-2026-1271 | ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Ima... |
| CVE-2026-12904 | Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/... |
| CVE-2026-12905 | Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference t... |
| CVE-2026-12906 | RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure |
| CVE-2026-1291 | Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation |
| CVE-2026-12945 | Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints |
| CVE-2026-12998 | Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draf... |
| CVE-2026-13116 | PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sen... |
| CVE-2026-13145 | WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR |
| CVE-2026-14165 | Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 |
| CVE-2026-14183 | Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR |
| CVE-2026-14184 | Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR |
| CVE-2026-14187 | Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR |
| CVE-2026-14195 | Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info |
| CVE-2026-14196 | WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR |
| CVE-2026-14197 | Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR |
| CVE-2026-14209 | Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions |
| CVE-2026-14211 | Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR |
| CVE-2026-14212 | Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR |
| CVE-2026-14213 | Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR |
| CVE-2026-14223 | Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR |
| CVE-2026-14224 | Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR |
| CVE-2026-14306 | Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass |
| CVE-2026-14793 | Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization |
| CVE-2026-14823 | Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR |
| CVE-2026-14825 | Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR |
| CVE-2026-14826 | Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR |
| CVE-2026-14832 | ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone |
| CVE-2026-14842 | Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass |
| CVE-2026-14843 | Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR |
| CVE-2026-14847 | Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR |
| CVE-2026-14857 | WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR |
| CVE-2026-14858 | WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR |
| CVE-2026-14861 | User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR |
| CVE-2026-15147 | Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR |
| CVE-2026-15159 | Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosu... |
| CVE-2026-15191 | mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization |
| CVE-2026-15209 | JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR |
| CVE-2026-15214 | Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR |
| CVE-2026-15231 | TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR |
| CVE-2026-15238 | Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR |
| CVE-2026-15255 | RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR |
| CVE-2026-15257 | RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification |
| CVE-2026-15260 | Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR |
| CVE-2026-25497 | Craft has a GraphQL Asset Mutation Privilege Escalation |
| CVE-2026-25530 | Kanboard is missing authorization check in getSwimlane API allows cross-project data access |
| CVE-2026-2554 | WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendo... |
| CVE-2026-25563 | WeKan < 8.19 Checklist Creation Cross-Board IDOR |
| CVE-2026-25564 | WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation |
| CVE-2026-25567 | WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId |
| CVE-2026-25574 | Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) |
| CVE-2026-26004 | Sentry allows unauthorized access to event data across organizational boundaries |
| CVE-2026-26016 | Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization |
| CVE-2026-26078 | Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint |
| CVE-2026-27397 | WordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-27449 | Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints |
| CVE-2026-27705 | Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch |
| CVE-2026-27708 | FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access |
| CVE-2026-27793 | Seerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials |
| CVE-2026-27835 | wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data |
| CVE-2026-27838 | wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data |
| CVE-2026-27839 | wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup |
| CVE-2026-27881 | Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) |
| CVE-2026-27883 | Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure |
| CVE-2026-28302 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28305 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28308 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28313 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28314 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28316 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28317 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-28354 | ClipBucket v5 has IDOR in Collection Item Management |
| CVE-2026-28361 | NocoDB: Missing Ownership Validation in MCP Token Operations |
| CVE-2026-28433 | Misskey lacks resource ownership validation |
| CVE-2026-28788 | Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite |
| CVE-2026-2879 | GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion |
| CVE-2026-2888 | Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter |
| CVE-2026-29002 | CouchCMS Privilege Escalation via f_k_levels_list Parameter |
| CVE-2026-29069 | Craft has an unauthenticated activation email trigger with potential user enumeration |
| CVE-2026-29071 | Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories |
| CVE-2026-2917 | Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via... |
| CVE-2026-2918 | Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scr... |
| CVE-2026-29189 | SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints |
| CVE-2026-29200 | A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. T... |
| CVE-2026-29204 | Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another us... |
| CVE-2026-3073 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-3074 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-30823 | Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration |
| CVE-2026-30825 | hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token |
| CVE-2026-30843 | Wekan has Cross-Board IDOR in Custom Fields Update Endpoints |
| CVE-2026-30857 | WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning |
| CVE-2026-3124 | Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'o... |
| CVE-2026-3139 | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object... |
| CVE-2026-3173 | Meta Field Block <= 1.5.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure |
| CVE-2026-31820 | Sylius affected by IDOR in Cart and Checkout LiveComponents |
| CVE-2026-31832 | Umbraco Backoffice API Allows Unauthorized Modification of Domain Data |
| CVE-2026-3185 | feiyuchuixue sz-boot-parent API Endpoint sys-message authorization |
| CVE-2026-31867 | Craft Commerce has a Potential IDOR in Commerce carts |
| CVE-2026-31869 | Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check |
| CVE-2026-31874 | Taskosaur Improper Role Assignment via Parameter Manipulation in User Registration |
| CVE-2026-31956 | Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization |
| CVE-2026-32131 | ZITADEL Cross-Tenant Information Disclosure in Management API |
| CVE-2026-32300 | Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information |
| CVE-2026-3235 | WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Ref... |
| CVE-2026-32638 | StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens |
| CVE-2026-32694 | Insecure Direct Object Reference attack via predictable secret ID in Juju |
| CVE-2026-32697 | SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR) |
| CVE-2026-32761 | File Browser has an Authorization Policy Bypass in its Public Share Download Flow |
| CVE-2026-32867 | OPEXUS eComplaint unauthenticated file upload |
| CVE-2026-33030 | Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys |
| CVE-2026-33052 | MantisBT: Authorization Bypass in Global Profile Creation |
| CVE-2026-33053 | Langflow has Missing Ownership Verification in API Key Deletion (IDOR) |
| CVE-2026-3306 | Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write acc... |
| CVE-2026-3307 | Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of dele... |
| CVE-2026-33141 | Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data |
| CVE-2026-33158 | Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) |
| CVE-2026-33160 | Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL |
| CVE-2026-33313 | Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments |
| CVE-2026-33345 | solidtime vulnerable to IDOR in private projects |
| CVE-2026-33356 | Meari MQTT broker missing per-device subscribe ACL |
| CVE-2026-33425 | Discourse has inferable private group membership or existence via exclude_groups parameter |
| CVE-2026-33663 | n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition |
| CVE-2026-33678 | Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion |
| CVE-2026-33700 | Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion |
| CVE-2026-33702 | Chamilo LMS has an Insecure Direct Object Reference (IDOR) |
| CVE-2026-33703 | Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens |
| CVE-2026-3371 | Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification |
| CVE-2026-33724 | n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no |
| CVE-2026-33730 | Open Source Point of Sale has an IDOR in Password Change (Home) |
| CVE-2026-33735 | MyTube has an Improper Access Control that Allows Complete Application Takeover |
| CVE-2026-33736 | Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure |
| CVE-2026-33740 | EspoCRM: Email importEml can import and delete another user's attachment by raw fileId |
| CVE-2026-34046 | Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check |
| CVE-2026-34055 | OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification |
| CVE-2026-34167 | Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor |
| CVE-2026-34213 | Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation |
| CVE-2026-34370 | Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes |
| CVE-2026-34444 | Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr |
| CVE-2026-3473 | Improper file ownership validation in the Boards API allows unauthorised file access |
| CVE-2026-3482 | IBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization Bypass |
| CVE-2026-34832 | Scoold: Cross-Account Feedback Deletion (IDOR) |
| CVE-2026-34985 | LORIS has incorrect access checks in media module |
| CVE-2026-35023 | Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php |
| CVE-2026-35045 | Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification |
| CVE-2026-35147 | HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. |
| CVE-2026-35165 | LORIS has incorrect access checks in document_repository |
| CVE-2026-35173 | Chyrp Lite has an IDOR via Mass Assignment in Post Model |
| CVE-2026-35183 | Brave CMS has an Insecure Direct Object Reference in Article Image Deletion |
| CVE-2026-35210 | OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection |
| CVE-2026-35430 | Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability |
| CVE-2026-35478 | InvenTree has Arbitrary API Token Creation |
| CVE-2026-35489 | Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` |
| CVE-2026-35584 | FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration |
| CVE-2026-3568 | MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update |
| CVE-2026-3688 | WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via U... |
| CVE-2026-37978 | Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api |
| CVE-2026-39331 | ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families |
| CVE-2026-39354 | Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask |
| CVE-2026-39374 | Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint |
| CVE-2026-39384 | FreeScout Customer Merge Cross-Mailbox Authorization Bypass |
| CVE-2026-39386 | Neko has Self-service Privilege Escalation for Authenticated Users |
| CVE-2026-39510 | WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39518 | WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39526 | WordPress WpStream plugin < 4.11.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39616 | WordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39942 | Directus has a Path Traversal and Broken Access Control in File Management API |
| CVE-2026-39967 | TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter |
| CVE-2026-39968 | TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint |
| CVE-2026-3999 | Broken access control vulnerability affecting ID Server |
| CVE-2026-40043 | Pachno 1.0.6 Authentication Bypass via runSwitchUser() |
| CVE-2026-40127 | Authorization Bypass Through User-Controlled Key in OutSystems Lifetime |
| CVE-2026-40252 | Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT |
| CVE-2026-40308 | My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog |
| CVE-2026-40480 | ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}` |
| CVE-2026-40570 | FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII |
| CVE-2026-40589 | FreeScout has Customer Edit Cross-Mailbox Email Takeover |
| CVE-2026-40590 | FreeScout's Customer AJAX Create Modifies Hidden Existing Customer |
| CVE-2026-40591 | FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification |
| CVE-2026-40600 | Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id |
| CVE-2026-40737 | WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40768 | WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40784 | WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40792 | WordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40865 | Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id> |
| CVE-2026-40866 | Horilla: Unauthorized Document Overwrite via File Upload Endpoint |
| CVE-2026-40867 | Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation |
| CVE-2026-40896 | OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup |
| CVE-2026-40907 | WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens |
| CVE-2026-40981 | When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config... |
| CVE-2026-41084 | Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation |
| CVE-2026-41127 | BigBlueButton's missing authorization allows viewer to inject/overwrite captions |
| CVE-2026-41141 | EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup |
| CVE-2026-41160 | EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes |
| CVE-2026-41267 | Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association |
| CVE-2026-41277 | Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR) |
| CVE-2026-41279 | Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials |
| CVE-2026-41372 | OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery |
| CVE-2026-41406 | OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages |
| CVE-2026-41471 | Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint |
| CVE-2026-4160 | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Ref... |
| CVE-2026-41649 | Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces |
| CVE-2026-4171 | CodeGenieApp serverless-express API Endpoint TodoList.ts authorization |
| CVE-2026-41878 | Insecure Direct Object Reference in R-SOFT DMS |
| CVE-2026-41906 | FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass |
| CVE-2026-41947 | Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints |
| CVE-2026-41949 | Dify < 1.14.2 Authorization Bypass via File Preview Endpoint |
| CVE-2026-41950 | Dify < 1.14.0 Authorization Bypass via File UUID |
| CVE-2026-4208 | Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email) |
| CVE-2026-42097 | Authentication Bypass in Sparx Pro Cloud Server |
| CVE-2026-42205 | Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources |
| CVE-2026-42227 | n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure |
| CVE-2026-42276 | Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions |
| CVE-2026-42277 | Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files |
| CVE-2026-42278 | UltraDAG: Smart Account Spending Policy Bypass via Pockets |
| CVE-2026-42279 | solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID |
| CVE-2026-42291 | SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional |
| CVE-2026-42456 | AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) |
| CVE-2026-42463 | SQLBot: Unauthorized Access Vulnerability |
| CVE-2026-42515 | Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS |
| CVE-2026-42516 | Broken Access Control Vulnerability in e-Sushrut HMIS |
| CVE-2026-42517 | Cryptographic Failure Vulnerability in e-Sushrut HMIS |
| CVE-2026-42572 | Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds` |
| CVE-2026-42609 | Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic |
| CVE-2026-42725 | WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-42736 | WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-42861 | Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment |
| CVE-2026-42862 | Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment |
| CVE-2026-42863 | Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment |
| CVE-2026-42889 | Relay Server WebSocket authentication bypass when token is omitted |
| CVE-2026-42947 | Naxclow IoT Platform Authorization bypass through User-Controlled key |
| CVE-2026-4330 | Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Ar... |
| CVE-2026-43883 | WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription... |
| CVE-2026-43890 | Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7) |
| CVE-2026-43917 | Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation |
| CVE-2026-43934 | e107: Broken Access Control in e107 comment edit allows cross-user comment modification |
| CVE-2026-43977 | wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API |
| CVE-2026-4398 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-4400 | Multiple vulnerabilities in 1millionbot Millie chatbot |
| CVE-2026-44083 | QuMagie |
| CVE-2026-44207 | Frappe: Insecure Direct Object Reference for email accounts |
| CVE-2026-44341 | GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint |
| CVE-2026-44400 | MailEnable Enterprise Premium < 10.55 Authorization Bypass via WebAdmin |
| CVE-2026-44423 | ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data |
| CVE-2026-44424 | ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace |
| CVE-2026-44426 | ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check |
| CVE-2026-44504 | Aegra: Cross-user run injection in /threads/{thread_id}/runs (IDOR) |
| CVE-2026-44544 | gittuf: Policy can be rolled back to prior valid version |
| CVE-2026-44570 | Open WebUI: Inconsistent authorization controls within memories API |
| CVE-2026-44585 | Paymenter: Broken object level authorization via service reference manipulation on ticket creation |
| CVE-2026-44678 | Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID |
| CVE-2026-44692 | Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint |
| CVE-2026-44718 | Mathesar: Missing collaborator checks allowed access to saved explorations in other databases |
| CVE-2026-44731 | OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET par... |
| CVE-2026-44732 | OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modifi... |
| CVE-2026-44736 | OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects |
| CVE-2026-44776 | Kavita: IDOR in /api/Download/* |
| CVE-2026-44986 | Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile |
| CVE-2026-4503 | Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint |
| CVE-2026-45120 | MyBB: Insufficient authorization for private calendar events |
| CVE-2026-45155 | Nextcloud: Private circle can be added to another circle via API |
| CVE-2026-45159 | Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owne... |
| CVE-2026-45281 | Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update |
| CVE-2026-45295 | FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoi... |
| CVE-2026-45297 | Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch |
| CVE-2026-45330 | Decidim: Verification admins can access supplied IDs from other organisations |
| CVE-2026-45342 | LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes |
| CVE-2026-45349 | Open WebUI: Broken Access Control for Completions API |
| CVE-2026-45385 | Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint |
| CVE-2026-45386 | Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint |
| CVE-2026-45398 | Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls |
| CVE-2026-45402 | Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints |
| CVE-2026-45414 | Decidim: JWT-backed authentication can be replayed across organizations |
| CVE-2026-4549 | mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization |
| CVE-2026-45550 | Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body |
| CVE-2026-45551 | Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write |
| CVE-2026-45552 | Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server |
| CVE-2026-45563 | Roxy-WI: IDOR — any authenticated user can read another user's full action history |
| CVE-2026-4563 | MacCMS Member Order Detail User.php order_info authorization |
| CVE-2026-45666 | Open WebUI: Indirect Object Reference (IDOR) in user notes |
| CVE-2026-45671 | Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion |
| CVE-2026-45732 | n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints |
| CVE-2026-45743 | Termix has a File-Manager Session Hijack via Missing Ownership Check (IDOR) |
| CVE-2026-45746 | Termix Vulnerable to Arbitrary Command Execution via Session Hijacking |
| CVE-2026-45750 | Termix Vulnerable to Arbitrary Command Execution in File Manager |
| CVE-2026-45760 | Apache Camel K: Camel K Cross-Namespace Build Deputy Attack |
| CVE-2026-45810 | Nextcloud: Propfind requests for file comments allowed to load comments for other files |
| CVE-2026-45830 | A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users t... |
| CVE-2026-45832 | All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization lay... |
| CVE-2026-4630 | Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference |
| CVE-2026-46390 | HAX CMS has Unauthenticated Git Access via User-Controlled Key |
| CVE-2026-46407 | Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens |
| CVE-2026-46408 | Vvveb: checkout IDOR allows unauthorized reuse of another user's cart |
| CVE-2026-46414 | Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking |
| CVE-2026-46441 | Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment |
| CVE-2026-46453 | Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header... |
| CVE-2026-4654 | Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access v... |
| CVE-2026-46544 | Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requesters |
| CVE-2026-46558 | Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in oth... |
| CVE-2026-46585 | Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP... |
| CVE-2026-46712 | Misskey: Lack of proper permission checks in Direct Messaging feature |
| CVE-2026-46721 | Broken Access Control in extension "Frontend User Registration" (sf_register) |
| CVE-2026-46764 | Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter |
| CVE-2026-47068 | Cross-session PubSub topic injection via URL parameter in phoenix_storybook |
| CVE-2026-47130 | NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering |
| CVE-2026-47189 | Quest Bot: AutoMod removal can delete rules from another guild by global rule ID |
| CVE-2026-47198 | Paymenter: URL parameter injection bypasses paid plan limits at checkout |
| CVE-2026-47226 | Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileg... |
| CVE-2026-47227 | Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules... |
| CVE-2026-47230 | Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders |
| CVE-2026-47231 | Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folder... |
| CVE-2026-47238 | ClipBucket: IDOR in videos subtitle editor |
| CVE-2026-47266 | Formie: Unauthenticated front-end submission editing can overwrite existing submissions |
| CVE-2026-47378 | NocoDB: Hidden Column Exposure in Public Shared View Endpoints |
| CVE-2026-47388 | NocoDB: Missing Ownership Check in MCP Attachment Read |
| CVE-2026-47399 | PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID |
| CVE-2026-47406 | praisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace ownership check, cross-workspace is... |
| CVE-2026-47407 | PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation |
| CVE-2026-47408 | praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership |
| CVE-2026-47414 | praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace l... |
| CVE-2026-47415 | praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete... |
| CVE-2026-47417 | praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and... |
| CVE-2026-47418 | praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/de... |
| CVE-2026-47419 | praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete... |
| CVE-2026-47704 | TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bo... |
| CVE-2026-47713 | AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration |
| CVE-2026-47715 | Bugsink: Issue event views can show an event from another project if its UUID is known |
| CVE-2026-47716 | Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known |
| CVE-2026-47743 | Shopper: Multiple data integrity and disclosure issues in admin Livewire components |
| CVE-2026-47755 | ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal |
| CVE-2026-48016 | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment |
| CVE-2026-48052 | Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request |
| CVE-2026-48067 | Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields |
| CVE-2026-48169 | PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API |
| CVE-2026-48206 | Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP clie... |
| CVE-2026-48494 | TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids |
| CVE-2026-48599 | Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding |
| CVE-2026-4868 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-48759 | TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion) |
| CVE-2026-48765 | TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding |
| CVE-2026-48783 | Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription |
| CVE-2026-48799 | Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook |
| CVE-2026-48868 | WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-48872 | WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerability |
| CVE-2026-48912 | Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files... |
| CVE-2026-4896 | WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Pr... |
| CVE-2026-49099 | Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client... |
| CVE-2026-49141 | WACRM Authorization Bypass via Automation Engine Endpoint |
| CVE-2026-49192 | Summary Service Insecure Direct Object Reference |
| CVE-2026-49221 | Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets |
| CVE-2026-49222 | Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' p... |
| CVE-2026-49223 | Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' produ... |
| CVE-2026-49224 | Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions |
| CVE-2026-49225 | Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions |
| CVE-2026-49226 | Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts |
| CVE-2026-49227 | Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts |
| CVE-2026-49228 | Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products |
| CVE-2026-49258 | Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) |
| CVE-2026-49296 | Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} |
| CVE-2026-49338 | Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) |
| CVE-2026-49339 | Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other us... |
| CVE-2026-49355 | OpenProject: Private work package data disclosure through single meeting agenda item API |
| CVE-2026-4958 | OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization |
| CVE-2026-49858 | API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate |
| CVE-2026-5006 | Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths |
| CVE-2026-50141 | Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation |
| CVE-2026-50167 | Kurrier: Authenticated cross-user authorization bypass in Kurrier API |
| CVE-2026-50194 | Steeltoe vulnerable to management-port isolation bypass via spoofed Host header |
| CVE-2026-50283 | Craft CMS: Unauthorized Deletion of Source Assets During File Replacement |
| CVE-2026-50530 | DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets |
| CVE-2026-5060 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authentic... |
| CVE-2026-5135 | Foreman: foreman: unauthorized modification of host configurations via broken access control |
| CVE-2026-5138 | Foreman: foreman: information disclosure via improper validation of nested request parameters |
| CVE-2026-5142 | Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass |
| CVE-2026-5167 | Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint |
| CVE-2026-5199 | Cross Namespace Access via Batch Operation |
| CVE-2026-5234 | LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Inv... |
| CVE-2026-5246 | Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization |
| CVE-2026-52699 | WordPress VikRentCar plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-52779 | OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized pr... |
| CVE-2026-52782 | OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[pro... |
| CVE-2026-52799 | Gogs: Missing Authorization in Attachment Download |
| CVE-2026-52812 | Gogs: LFS dedupe path leaks private repo content across tenants |
| CVE-2026-52837 | Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page |
| CVE-2026-52839 | Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypas... |
| CVE-2026-52841 | Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Googl... |
| CVE-2026-52869 | MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal |
| CVE-2026-5309 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-5326 | SourceCodester Leave Application System User Information index.php authorization |
| CVE-2026-5337 | Frontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary Download Access via IDOR |
| CVE-2026-53447 | Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID |
| CVE-2026-53470 | Migration-planner: getsourcedownloadurl missing organization check |
| CVE-2026-53471 | Migration-planner: agent api ignores jwt source_id claim |
| CVE-2026-5348 | Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure |
| CVE-2026-53536 | Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL |
| CVE-2026-53546 | Termix: Missing authorization in SSH host credential resolution exposes stored credentials |
| CVE-2026-53548 | Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users |
| CVE-2026-53643 | FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints |
| CVE-2026-53644 | FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders |
| CVE-2026-53673 | BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter |
| CVE-2026-53675 | BuddyPress 14.4.0 Friends List IDOR via REST API |
| CVE-2026-53726 | Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL |
| CVE-2026-53729 | DataEase ExportCenter IDOR allows cross-user export task access |
| CVE-2026-53863 | OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy |
| CVE-2026-53903 | Insecure Direct Object Reference in MCO |
| CVE-2026-53911 | Cerebrate primary key mass assignment in CRUD edit operations allows authenticated users to overwrite unrelated records |
| CVE-2026-5395 | Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter |
| CVE-2026-5396 | Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter |
| CVE-2026-54006 | Open WebUI: Calendar event re-parenting allows writing events into another user's calendar |
| CVE-2026-54009 | Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field |
| CVE-2026-54010 | Open WebUI: Forged chat-file link allows cross-user file read and deletion |
| CVE-2026-54015 | Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion |
| CVE-2026-54016 | Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration |
| CVE-2026-54052 | n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments |
| CVE-2026-54097 | File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix |
| CVE-2026-54105 | U.S. GAO EPDS and CBCA EDS user information disclosure |
| CVE-2026-54184 | WordPress Clean Login plugin <= 1.15 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-54256 | Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata |
| CVE-2026-54322 | Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles |
| CVE-2026-54324 | Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join |
| CVE-2026-54357 | MISP improper authorization allows organization administrators to modify site administrator user settings |
| CVE-2026-54360 | MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups |
| CVE-2026-54361 | MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records |
| CVE-2026-54553 | Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS |
| CVE-2026-54568 | Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info |
| CVE-2026-5459 | User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticate... |
| CVE-2026-54590 | AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion |
| CVE-2026-54602 | FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord |
| CVE-2026-54622 | django CMS: Clipboard copy IDOR discloses unauthorized plugin content |
| CVE-2026-5465 | Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Paramet... |
| CVE-2026-54746 | Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe |
| CVE-2026-54826 | WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-54839 | WordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulne... |
| CVE-2026-55065 | Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api |
| CVE-2026-55066 | Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id |
| CVE-2026-55067 | Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment |
| CVE-2026-55166 | Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator... |
| CVE-2026-55197 | Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint |
| CVE-2026-55198 | Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint |
| CVE-2026-55228 | Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private projec... |
| CVE-2026-5523 | Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Updat... |
| CVE-2026-55234 | Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a... |
| CVE-2026-55255 | Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow |
| CVE-2026-55411 | ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any... |
| CVE-2026-55418 | FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure) |
| CVE-2026-55429 | Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID |
| CVE-2026-55478 | Snipe-IT: Missing object-level authorization in Kits API |
| CVE-2026-55482 | Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update |
| CVE-2026-55489 | BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass |
| CVE-2026-55515 | Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint |
| CVE-2026-55516 | Snipe-IT: Cross-company asset maintenance re-parenting via API update |
| CVE-2026-55518 | Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Esc... |
| CVE-2026-55544 | NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering |
| CVE-2026-55583 | Twenty: Cross-workspace IDOR in AgentTurnResolver |
| CVE-2026-55604 | @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key |
| CVE-2026-55611 | AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion) |
| CVE-2026-55670 | ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers |
| CVE-2026-55694 | Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover |
| CVE-2026-55739 | Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion |
| CVE-2026-55867 | Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens |
| CVE-2026-55880 | OpenReplay: Cross-user IDOR in notes and dashboard widgets |
| CVE-2026-55881 | OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint |
| CVE-2026-56013 | WordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-56048 | WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR)... |
| CVE-2026-56069 | WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-56093 | Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) |
| CVE-2026-56147 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment... |
| CVE-2026-5617 | Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie |
| CVE-2026-56215 | Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning |
| CVE-2026-56222 | Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings |
| CVE-2026-56229 | Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs |
| CVE-2026-56230 | Capgo - Broken Object Level Authorization via x-limited-key-id Header |
| CVE-2026-56385 | Craft CMS - Authorization Bypass in assets/preview-file Endpoint |
| CVE-2026-56422 | MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields |
| CVE-2026-56424 | Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event rep... |
| CVE-2026-5652 | Authorization Bypass Through User-Controlled Key in Crafty Controller |
| CVE-2026-56721 | CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController |
| CVE-2026-56765 | Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR |
| CVE-2026-56772 | NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint |
| CVE-2026-56774 | Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID |
| CVE-2026-56780 | Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API |
| CVE-2026-56781 | Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override |
| CVE-2026-56784 | OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint |
| CVE-2026-56823 | AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering |
| CVE-2026-57205 | SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints |
| CVE-2026-5730 | IDOR in Idvlabs' Ontime |
| CVE-2026-57341 | WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (ID... |
| CVE-2026-57494 | AgenticMail: Cross-agent task authorization bypass in AgenticMail API |
| CVE-2026-57498 | Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers |
| CVE-2026-5750 | Insecure direct object reference (IDOR) vulnerability in Fullstep |
| CVE-2026-57510 | SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC |
| CVE-2026-57630 | WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57634 | WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57646 | WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57652 | WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57665 | WordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57676 | WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57680 | WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57694 | WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-57868 | MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroR... |
| CVE-2026-57869 | Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate all... |
| CVE-2026-57870 | Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates use... |
| CVE-2026-57886 | Cross-repository issue/comment attachment re-linking can expose private attachment content |
| CVE-2026-57943 | LibrePhotos < 1.0.0 - Insecure Direct Object Reference in SetPhotosShared Endpoint |
| CVE-2026-57945 | PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint |
| CVE-2026-57956 | SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules |
| CVE-2026-5798 | Unsafe Object Reference (IDOR) vulnerability in Stel Order |
| CVE-2026-5799 | IDOR in Idvlabs' Ontime |
| CVE-2026-58410 | ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records |
| CVE-2026-5842 | decolua 9router Administrative API Endpoint api authorization |
| CVE-2026-58432 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical R... |
| CVE-2026-58435 | Gitea LFS Deploy-Key Privilege Escalation |
| CVE-2026-58445 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API |
| CVE-2026-58447 | Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check |
| CVE-2026-5845 | Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server |
| CVE-2026-58580 | LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes |
| CVE-2026-58650 | Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-58653 | PraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/Update |
| CVE-2026-58660 | Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop |
| CVE-2026-59098 | LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search |
| CVE-2026-59100 | LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations |
| CVE-2026-59190 | Grav Admin Plugin — IDOR Privilege Escalation via saveUser() |
| CVE-2026-59215 | Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding |
| CVE-2026-59216 | Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id |
| CVE-2026-59233 | Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation |
| CVE-2026-59234 | Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion |
| CVE-2026-59235 | Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts |
| CVE-2026-59236 | Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection |
| CVE-2026-59237 | IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders |
| CVE-2026-59240 | IDOR in Prospero Flow CRM allows deletion of other users' notifications |
| CVE-2026-59253 | n8n - Improper Authorization in Workflow Assignment to Folders |
| CVE-2026-59254 | n8n - External Secrets Disclosure via Workflow Node Expressions |
| CVE-2026-59259 | n8n - Permission Bypass via Expression Parser Mismatch in External Secrets |
| CVE-2026-59539 | WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-59546 | WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability |
| CVE-2026-59712 | Leantime - JSON-RPC API Broken Access Control via users.getUser |
| CVE-2026-59733 | rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite a... |
| CVE-2026-59817 | Ghost: Paid gift memberships obtainable at minimal cost via the donations feature |
| CVE-2026-59992 | Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) |
| CVE-2026-6001 | IDOR in Abis Technology's BAPSİS |
| CVE-2026-6008 | IDOR in Im Park's DijiDemi |
| CVE-2026-60104 | Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request |
| CVE-2026-6062 | IDOR in Jira plugin subscription edit endpoint |
| CVE-2026-6063 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-6072 | Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header |
| CVE-2026-61460 | Krayin CRM Insecure Direct Object Reference via Controllers |
| CVE-2026-61574 | authentik RAC: access any endpoint via an unrelated application |
| CVE-2026-61663 | django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privile... |
| CVE-2026-61836 | Directus: Authorization-dependent response served from unsegmented cache key |
| CVE-2026-61946 | WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-61971 | WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-6206 | MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Quer... |
| CVE-2026-6212 | IDOR in Teracity's TeraMIS |
| CVE-2026-62233 | grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey |
| CVE-2026-62283 | Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check |
| CVE-2026-62666 | Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA... |
| CVE-2026-62861 | TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain |
| CVE-2026-62945 | TREK: Cross-trip reservation title disclosure via file links |
| CVE-2026-63003 | django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass... |
| CVE-2026-63095 | Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint |
| CVE-2026-63099 | TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints |
| CVE-2026-63178 | Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-gro... |
| CVE-2026-63259 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure |
| CVE-2026-63307 | Chat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasource |
| CVE-2026-63669 | ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank p... |
| CVE-2026-63735 | SurrealDB before 3.2.0 Authentication Bypass via Custom API |
| CVE-2026-63745 | SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id |
| CVE-2026-6375 | Authorization bypass through User-Controlled key in SpiceJet Online Booking System |
| CVE-2026-63763 | SurrealDB before 2.5.0 Privilege Escalation via Future Fields |
| CVE-2026-6444 | A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific co... |
| CVE-2026-64662 | Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries |
| CVE-2026-64927 | Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.... |
| CVE-2026-64961 | Authentication Bypass in ATutor |
| CVE-2026-64969 | Insecure Direct Object Reference in ATutor |
| CVE-2026-65013 | Onlook tRPC Insecure Direct Object Reference via multiple procedures |
| CVE-2026-65016 | n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role |
| CVE-2026-65316 | xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat |
| CVE-2026-6541 | Unscoped updates to other playbooks' metric configuration |
| CVE-2026-6542 | Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id |
| CVE-2026-65456 | WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-65463 | WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-65501 | WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-6552 | Без описания... |
| CVE-2026-65523 | WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vu... |
| CVE-2026-65642 | Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated use... |
| CVE-2026-6566 | Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image... |
| CVE-2026-65696 | Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API |
| CVE-2026-65699 | AgentGPT 1.0.0 Authorization Bypass via Agent Task Creation |
| CVE-2026-6570 | kodcloud KodExplorer systemMember.class.php initInstall authorization |
| CVE-2026-65708 | sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController |
| CVE-2026-65709 | sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API |
| CVE-2026-6571 | kodcloud KodExplorer systemRole.class.php roleGroupAction authorization |
| CVE-2026-65710 | sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption |
| CVE-2026-6583 | TransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization |
| CVE-2026-6584 | TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization |
| CVE-2026-6585 | TransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorization |
| CVE-2026-6586 | TransformerOptimus SuperAGI Budget Endpoint budget.py update_budget authorization |
| CVE-2026-65917 | CyberPanel IncBackups IDOR via Sequential Backup ID |
| CVE-2026-65981 | Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover |
| CVE-2026-66013 | OpenRemote before 1.26.2 Authentication Bypass via Console Registration |
| CVE-2026-66058 | Frappe: Unrestricted access to a Document Follow API |
| CVE-2026-6612 | TransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization |
| CVE-2026-6613 | TransformerOptimus SuperAGI agent.py get_schedule_data authorization |
| CVE-2026-6614 | TransformerOptimus SuperAGI project.py get_projects_organisation authorization |
| CVE-2026-66412 | Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC |
| CVE-2026-66634 | WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-66692 | WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (I... |
| CVE-2026-66764 | Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items) |
| CVE-2026-66878 | Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.n... |
| CVE-2026-67329 | @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription |
| CVE-2026-67331 | better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass |
| CVE-2026-67342 | ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers |
| CVE-2026-67348 | Julep Insecure Direct Object Reference via GET /executions/{execution_id} |
| CVE-2026-67358 | Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 |
| CVE-2026-67359 | Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 |
| CVE-2026-67360 | Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 |
| CVE-2026-67622 | Flowise 3.1.4 IDOR in OpenAI Assistants Integration |
| CVE-2026-6802 | Easy Upload Files During Checkout <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufd... |
| CVE-2026-68076 | Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection |
| CVE-2026-6810 | Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover |
| CVE-2026-68500 | Sylius Mollie Plugin: Payment status forgery via the payment webhook |
| CVE-2026-68501 | Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII |
| CVE-2026-68559 | Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`) |
| CVE-2026-68582 | Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token |
| CVE-2026-68870 | Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's C... |
| CVE-2026-68871 | Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variabl... |
| CVE-2026-68872 | Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connec... |
| CVE-2026-69094 | Admidio before 5.0.11 IDOR via save_temporary mylist_function.php |
| CVE-2026-69114 | Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass |
| CVE-2026-69117 | NetBox 4.5.8 ORM Injection via WritableNestedSerializer |
| CVE-2026-69119 | Taubyte Tau v1.1.10 Missing Authorization via POST /projects/{id} |
| CVE-2026-69129 | KubePi: Insufficient per-cluster authorization checks in cluster management APIs |
| CVE-2026-69160 | OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API |
| CVE-2026-69189 | Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers |
| CVE-2026-69250 | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration |
| CVE-2026-69258 | Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API |
| CVE-2026-69558 | Microsoft Partner Center Information Disclosure Vulnerability |
| CVE-2026-6965 | Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET... |
| CVE-2026-6976 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-70476 | Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation |
| CVE-2026-70488 | Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup |
| CVE-2026-70557 | diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts |
| CVE-2026-70561 | TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php |
| CVE-2026-71242 | Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy |
| CVE-2026-71251 | Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint |
| CVE-2026-71308 | Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates |
| CVE-2026-71417 | Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it |
| CVE-2026-7144 | 1000 Projects Portfolio Management System MCA update_passwd_process.php authorization |
| CVE-2026-7145 | mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization |
| CVE-2026-71505 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route |
| CVE-2026-71507 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes |
| CVE-2026-7201 | CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity |
| CVE-2026-72543 | OpenSignLabs OpenSign - Insecure Direct Object Reference |
| CVE-2026-72545 | OpenSignLabs OpenSign - Insecure Direct Object Reference |
| CVE-2026-72546 | Attendize Attendize - Insecure Direct Object Reference |
| CVE-2026-72547 | Attendize Attendize - Insecure Direct Object Reference |
| CVE-2026-72564 | fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication |
| CVE-2026-72629 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models |
| CVE-2026-72650 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure |
| CVE-2026-72657 | Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure |
| CVE-2026-72666 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts |
| CVE-2026-72680 | Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification |
| CVE-2026-72689 | OpenSignLabs opensignserver - Broken Object Level Authorization |
| CVE-2026-72690 | Attendize Attendize - Cross-Tenant Authorization Bypass |
| CVE-2026-72724 | Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch |
| CVE-2026-72734 | Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registrati... |
| CVE-2026-72737 | Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups |
| CVE-2026-72741 | Rainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access |
| CVE-2026-72763 | n8n before 1.123.67 Credential Exfiltration via Sub-Workflow |
| CVE-2026-72774 | n8n before 1.123.67 Authentication Bypass via HTTP Request Node |
| CVE-2026-72802 | SiYuan before v3.7.4 Information Disclosure via resolveAssetPath |
| CVE-2026-72863 | Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host |
| CVE-2026-72876 | Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* |
| CVE-2026-73039 | streama Insecure Direct Object Reference via ViewingStatusController |
| CVE-2026-73068 | ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write anoth... |
| CVE-2026-73239 | Apache Allura: Missing permission checks IDOR |
| CVE-2026-73298 | Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes |
| CVE-2026-73303 | Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) |
| CVE-2026-73395 | WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerabil... |
| CVE-2026-73488 | Flowise before 3.1.3 IDOR via customer-default-source endpoint |
| CVE-2026-73606 | SiYuan before v3.7.4 Information Disclosure via getRefIDs |
| CVE-2026-73610 | SiYuan before v3.7.4 Information Disclosure via Local Storage |
| CVE-2026-73612 | File Browser before v2.63.22 Authorization Bypass via Recursive Operations |
| CVE-2026-73616 | OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference |
| CVE-2026-73644 | OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user witho... |
| CVE-2026-73656 | Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state |
| CVE-2026-73657 | Trigger.dev: Cross-tenant payload poisoning via packet write + replay |
| CVE-2026-73841 | OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints |
| CVE-2026-7399 | IDOR in MeWare Software's PDKS |
| CVE-2026-74009 | WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-74242 | Quay: repository notification uuid idor in quay api |
| CVE-2026-74771 | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability... |
| CVE-2026-74877 | openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key |
| CVE-2026-19869 | Privilege Escalation via Dropped Field-Level @authentication |
| CVE-2026-1987 | Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification |
| CVE-2026-19870 | IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation |
| CVE-2026-1989 | IDOR in PAVO Inc.'s PAVO Pay |
| CVE-2026-1992 | ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation |
| CVE-2026-19966 | CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization |
| CVE-2026-19979 | GL.iNet XE3000 WebDAV Service MOVE authorization |
| CVE-2026-19994 | Webkul Bagisto Configuration Management execute authorization |
| CVE-2026-19997 | Webkul Bagisto Backend Sales RMA Endpoint requests authorization |
| CVE-2026-20897 | Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) |
| CVE-2026-20904 | Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes |
| CVE-2026-20912 | Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure |
| CVE-2026-2104 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-21447 | Bagisto has IDOR in Customer Order Reorder Functionality |
| CVE-2026-23638 | Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-2366 | Keycloak: keycloak: information disclosure via authorization bypass in admin api |
| CVE-2026-23754 | D-Link D-View 8 IDOR Allows Credential Disclosure and Account Takeover |
| CVE-2026-23843 | teklifolustur_app's IDOR vulnerability allows unauthorized access to other users' offers |
| CVE-2026-2398 | IDOR in AdamPOS' MobilMen 20T |
| CVE-2026-2406 | IDOR in Universe Software's Online Registration and Workflow Management System |
| CVE-2026-24134 | StudioCMS has an Authorization Bypass Through User-Controlled Key |
| CVE-2026-24136 | Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API |
| CVE-2026-2414 | Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects... |
| CVE-2026-24178 | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated a... |
| CVE-2026-24379 | WordPress WP Job Portal plugin <= 2.4.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24599 | WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-2461 | Missing authorization check allows unauthorized modification of other users' comments on a board |
| CVE-2026-24631 | WordPress Rosebud theme <= 1.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24634 | WordPress Ultimate Reviews plugin <= 3.2.16 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24753 | Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-24755 | Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-24756 | Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-24761 | Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-24773 | Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Files |
| CVE-2026-24776 | OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer |
| CVE-2026-24900 | MarkUs has a submission-view IDOR exposes all student submissions |
| CVE-2026-24901 | Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts |
| CVE-2026-24950 | WordPress Authorsy plugin <= 1.0.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24991 | WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-25005 | WordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-25120 | Gogs Allows Cross-Repository Comment Deletion via DeleteComment |
| CVE-2026-25147 | OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid |
| CVE-2026-25197 | Gardyn Cloud API Authorization Bypass Through User-Controlled Key |
| CVE-2026-25220 | OpenEMR Messages "Show All" Not Restricted to Admins |
| CVE-2026-25324 | WordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-25654 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user a... |
| CVE-2026-25744 | OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals |
| CVE-2026-25745 | OpenEMR's Message Update Ignores Patient id |
| CVE-2026-25757 | Unauthenticated Spree Commerce users can view completed guest orders by Order ID |
| CVE-2026-25758 | Spree allows unauthenticated users can access all guest addresses |
| CVE-2026-25782 | Gitea tracked-time deletion can target entries from another issue |
| CVE-2026-25927 | OpenEMR Missing Authorization Checks in DICOM Viewer State API |
| CVE-2026-25929 | OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval |
| CVE-2026-25930 | OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms |
| CVE-2026-2729 | Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe Pay... |
| CVE-2026-27329 | WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-27591 | Winter: Privilege escalation by authenticated backend users |
| CVE-2026-27657 | Gitea email settings allow changing another user's primary email address |
| CVE-2026-28155 | WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-28180 | WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-28216 | hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment |
| CVE-2026-28225 | Manyfold has IDOR in ModelFilesController |
| CVE-2026-28444 | Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure |
| CVE-2026-28469 | OpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity |
| CVE-2026-28503 | Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404 |
| CVE-2026-77368 | SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths |
| CVE-2026-77759 | IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records |
| CVE-2026-77768 | OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access |
| CVE-2026-77769 | OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries |
| CVE-2026-77776 | Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity |
| CVE-2026-77780 | Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosu... |
| CVE-2026-77789 | Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR |
| CVE-2026-7782 | CodeCanyon Perfex CRM Tenant Clients.php project authorization |
| CVE-2026-7787 | Unauthenticated Session History Access via Public Flow Execution |
| CVE-2026-77990 | Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 |
| CVE-2026-77995 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 |
| CVE-2026-77998 | Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO <... |
| CVE-2026-78139 | Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR |
| CVE-2026-78142 | code-projects Barangay Resident Profiling Management System Restore/Delete archived_records.php authorization |
| CVE-2026-78144 | code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization |
| CVE-2026-78160 | Dolibarr ERP User Notes note.php authorization |
| CVE-2026-78203 | Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap |
| CVE-2026-78278 | WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-78365 | IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification |
| CVE-2026-78581 | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana |
| CVE-2026-7881 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block |
| CVE-2026-7886 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter |
| CVE-2026-79615 | Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR |
| CVE-2026-79654 | Ketello: katello content view history api cross-organization authorization bypass |
| CVE-2026-79995 | User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR |
| CVE-2026-80049 | Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId |
| CVE-2026-80197 | Kimai before 2.57.0 Improper Authorization via Favorite Endpoints |
| CVE-2026-8027 | FlowiseAI Flowise User Controller authorization |
| CVE-2026-80311 | Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR |
| CVE-2026-81031 | IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update |
| CVE-2026-81200 | MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR |
| CVE-2026-81299 | WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-8155 | BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR |
| CVE-2026-81576 | Improper Authentication of Session Handles |
| CVE-2026-81658 | Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup |
| CVE-2026-81668 | Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup |
| CVE-2026-81817 | Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification |
| CVE-2026-81853 | AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle |
| CVE-2026-8196 | JeecgBoot mLogin Endpoint LoginController.java authorization |
| CVE-2026-8204 | Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog |
| CVE-2026-82271 | R2R Missing Ownership Check Allows Modifying Other Users' Conversations |
| CVE-2026-82280 | Quivr Prompt Endpoints Missing Ownership Validation |
| CVE-2026-82281 | Kotaemon Missing Ownership Check in Conversation Functions |
| CVE-2026-82283 | VoltAgent Memory API Handlers Missing Ownership Checks |
| CVE-2026-82284 | Quivr Chat Endpoints Missing Ownership Validation |
| CVE-2026-82290 | Chainlit Feedback Endpoints Missing Ownership Validation |
| CVE-2026-82564 | Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records |
| CVE-2026-82602 | SeaCMS ass.php authorization |
| CVE-2026-82621 | Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization |
| CVE-2026-82725 | AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data |
| CVE-2026-8337 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private su... |
| CVE-2026-8347 | Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog |
| CVE-2026-8379 | Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download |
| CVE-2026-8406 | openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail |
| CVE-2026-8786 | Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization |
| CVE-2026-8828 | A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to a... |
| CVE-2026-8839 | MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints |
| CVE-2026-9248 | Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to... |
| CVE-2026-9306 | QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization |
| CVE-2026-9341 | Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter |
| CVE-2026-22406 | WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22407 | WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22409 | WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22411 | WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22426 | WordPress Sweet Jane theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22430 | WordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22489 | WordPress Image Slider Slideshow plugin <= 1.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-2257 | GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API |
| CVE-2026-22588 | Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification |
| CVE-2026-22589 | Spree API has Unauthenticated IDOR - Guest Address |
| CVE-2026-2346 | IDOR in Menulux Software's Mobile App |
| CVE-2026-2347 | IDOR in Akıllı Ticaret's E-Commerce Pack |
| CVE-2026-23478 | Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback |
| CVE-2026-23487 | Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token |
| CVE-2026-23488 | Blinko: multiple interfaces in the comment feature allow unauthorized access |
| CVE-2026-23522 | Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion |
| CVE-2026-2697 | Indirect Object Reference (IDOR) in Security Center |
| CVE-2026-2698 | Improper Access Control |
| CVE-2026-27898 | Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher |
| CVE-2026-27943 | OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership |
| CVE-2026-27956 | Coolify: Cross-team application domain enumeration via domains_by_server endpoint |
| CVE-2026-28696 | Craft affected by IDOR via GraphQL @parseRefs |
| CVE-2026-28736 | Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) |
| CVE-2026-28740 | Gitea LFS object reuse bypasses Code-unit authorization |
| CVE-2026-28747 | Milesight Cameras Authorization Bypass Through User-Controlled Key |
| CVE-2026-28781 | Craft Affected by Entries Authorship Spoofing via Mass Assignment |
| CVE-2026-28782 | Craft has a Permission Bypass and IDOR in Duplicate Entry Action |
| CVE-2026-2997 | WisdomGarden｜Tronclass - Insecure Direct Object Reference |
| CVE-2026-3020 | Identity based authorization bypass vulnerability (IDOR) in the Wakyma application web |
| CVE-2026-30230 | Flare: Password‑Protected Thumbnail Bypass |
| CVE-2026-30231 | Flare: Private File IDOR via raw/direct endpoints |
| CVE-2026-30884 | mdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-30886 | New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check |
| CVE-2026-30920 | OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding |
| CVE-2026-30927 | Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter |
| CVE-2026-30944 | StudioCMS Affected by Privilege Escalation via Insecure API Token Generation |
| CVE-2026-30945 | StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service |
| CVE-2026-30954 | LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy() |
| CVE-2026-30959 | OneUptime has WhatsApp Resend Verification Authorization Bypass |
| CVE-2026-30969 | Coral Server has insufficient agent authentication in session communication channels |
| CVE-2026-32039 | OpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender |
| CVE-2026-32097 | PingPong has improper access control in thread file endpoints allows access outside intended scope |
| CVE-2026-32103 | StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation |
| CVE-2026-32104 | StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings |
| CVE-2026-32114 | Discourse's unscoped status lookups leak restricted metadata |
| CVE-2026-32120 | OpenEMR has IDOR in Fee Sheet Product Save |
| CVE-2026-32533 | WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-32535 | WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-32589 | Mirror-registry: quay: insecure direct object reference in blobupload |
| CVE-2026-32894 | Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result |
| CVE-2026-32930 | Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check |
| CVE-2026-32976 | OpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands |
| CVE-2026-3321 | Authorization Bypass in ON24 Q&A chat |
| CVE-2026-33297 | AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php |
| CVE-2026-33304 | OpenEMR has Authorization Bypass in Dated Reminders Log |
| CVE-2026-33484 | Langflow has Unauthenticated IDOR on Image Downloads |
| CVE-2026-33511 | pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad |
| CVE-2026-33759 | AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents |
| CVE-2026-33760 | Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints |
| CVE-2026-33764 | AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions |
| CVE-2026-33931 | OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access |
| CVE-2026-33934 | OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures |
| CVE-2026-33946 | MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay |
| CVE-2026-34037 | Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() |
| CVE-2026-34044 | Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) |
| CVE-2026-3453 | ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation... |
| CVE-2026-3454 | GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via... |
| CVE-2026-34584 | listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment) |
| CVE-2026-34592 | Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure |
| CVE-2026-34602 | Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses |
| CVE-2026-7491 | Zyosoft｜School App - Insecure Direct Object Reference |
| CVE-2026-74930 | WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR |
| CVE-2026-7502 | LinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization |
| CVE-2026-7510 | OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization |
| CVE-2026-75103 | Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover |
| CVE-2026-75105 | phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter |
| CVE-2026-7573 | GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations |
| CVE-2026-75950 | Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 |
| CVE-2026-75951 | Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory <... |
| CVE-2026-76073 | Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset |
| CVE-2026-76216 | Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing |
| CVE-2026-76236 | stigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones |
| CVE-2026-76237 | stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine |
| CVE-2026-76263 | Improper Access Control through the REST API in Splunk Enterprise |
| CVE-2026-7638 | App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification vi... |
| CVE-2026-76397 | Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit |
| CVE-2026-7648 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to... |
| CVE-2026-7651 | User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Del... |
| CVE-2026-76634 | WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php |
| CVE-2026-7665 | Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX... |
| CVE-2026-7681 | jsbroks COCO Annotator Dataset API datasets.py authorization |
| CVE-2026-7702 | toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization |
| CVE-2026-77035 | Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Ma... |
| CVE-2026-77073 | n8n before 2.34.1 Cross-Project Credential Access via MCP |
| CVE-2026-77079 | n8n before 2.34.1 Authorization Bypass via Custom Role Deletion |
| CVE-2026-77081 | n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node |
| CVE-2026-77116 | Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview |
| CVE-2026-77127 | Information Disclosure in extension "Modules" (modules) |
| CVE-2026-77135 | Information Disclosure in extension "femanager" (femanager) |
| CVE-2026-77140 | Broken Access Control in extension "Telephone Directory" (telephonedirectory) |
| CVE-2026-77141 | Broken Access Control in extension "Club Directory" (clubdirectory) |
| CVE-2026-77142 | Broken Access Control in extension "Industry Directory" (yellowpages2) |
| CVE-2026-77143 | Broken Access Control in extension "Forum" (pforum) |
| CVE-2026-77145 | Broken Access Control in extension "Events 2" (events2) |
| CVE-2026-8611 | Klamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information... |
| CVE-2026-8629 | Crabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpoints |
| CVE-2026-8679 | AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter |
| CVE-2026-8890 | code100x Mobile API Authentication Bypass via Header Spoofing |
| CVE-2026-9087 | Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login |
| CVE-2026-9099 | Keycloak: group-admin escalation to realm-admin |
| CVE-2026-9136 | Unauthorized ShadowAttribute modification in MISP via client-supplied identifier |
| CVE-2026-9152 | Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction |
| CVE-2026-9180 | MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Par... |
| CVE-2026-9185 | 6Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification v... |
| CVE-2026-9188 | Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference... |
| CVE-2026-9228 | Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensit... |
| CVE-2026-9241 | FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Con... |
| CVE-2026-9493 | BankPro E-Service Technology｜Service Center - Insecure Direct Object Reference |
| CVE-2026-9708 | Incoming webhook user attribution via unvalidated webhook owner |
| CVE-2026-9712 | Insecure direct object reference |
| CVE-2026-9799 | Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass |
| CVE-2026-9851 | Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action |
| CVE-2025-24976 | Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT |
Exploits & Shellcodes
| Идентификатор | Тип | Описание | Дата публикации |
|---|---|---|---|
| EDB-52464 | Exploit | Chained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie | 25.12.2025 |
| EDB-52302 | Exploit | WordPress User Registration & Membership Plugin 4.1.2 - Authentication Bypass | 25.05.2025 |
| EDB-52291 | Exploit | WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation | 13.05.2025 |
| EDB-52264 | Exploit | UJCMS 9.6.3 - User Enumeration via IDOR | 18.04.2025 |
| EDB-51659 | Exploit | Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR | 04.08.2023 |
НКЦКИ уязвимости
Бюллетени НКЦКИ - уязвимости ПО
| Идентификатор | Дата бюллетеня | Описание |
|---|---|---|
| VULN:20231222-28 | 22.12.2023 | Обход безопасности в ETL3100 |
| VULN:20240110-7 | 10.01.2024 | Обход безопасности в SIMATIC CN 4100 |
| VULN:20240325-20 | 25.03.2024 | Получение конфиденциальной информации в FortiOS |
| VULN:20240916-18 | 16.09.2024 | Обход безопасности в Siemens Industrial Edge Management |
| VULN:20260610-28 | 10.06.2026 | Внедрение кода в Gitlab |
| VULN:20260610-67 | 10.06.2026 | Получение конфиденциальной информации в moodle-mod_customcert |
| VULN:20260819-101 | 19.08.2026 | Обход безопасности в Langflow |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.