191501 matches found
CVE-2026-82848 Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure
The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...
EUVD-2026-74712
The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...
EUVD-2026-74706
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it...
EUVD-2026-74699
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...
CVE-2026-21109
Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information...
CVE-2026-21099
Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information...
CVE-2026-21105
Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information...
CVE-2026-21098
Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...
CVE-2026-21100
Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity...
CVE-2026-21109
CVE-2026-21109 is an improper access control vulnerability in Samsung's Watch Plugin , affecting versions prior to Android Watch 17 . A local attacker with no required privileges can access sensitive information , resulting in low confidentiality impact. The CVSS 4.0 score is 2.1 (LOW) , with an ...
EUVD-2026-74650
Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information...
CVE-2026-21109
Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information...
CVE-2026-21109
Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information...
CVE-2026-21105
Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information...
EUVD-2026-74646
Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information...
CVE-2026-21105
Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information...
CVE-2026-21105
An improper access control flaw in Samsung's Collection app on Android 15 (prior to version 1.0.1.14) and Android 16 (prior to version 2.0.02.7) allows local attackers to access sensitive information without requiring privileges or user interaction. The vulnerability is rated CVSS 4.0 5.9 (MEDIUM...
CVE-2026-21100
Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity...