CVE-2026-92915: Allocation of Resources Without Limits or Throttling

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...

PT-2026-94238

Name of the Vulnerable Software and Affected Versions WWBN AVideo through commit e01e41ecc Description A broken access control flaw exists in the 'objects/userVerifyEmail.php' endpoint. The script disables login requirements via the $global'ignoreUserMustBeLoggedIn' variable and accepts the users...

PT-2026-94254

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

PT-2026-94346

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.7.0 Description An account takeover issue exists in the headless commerce platform where the ExternalAuthenticationService.createCustomerAndUser function links a new external authentication method to an existing use...

PT-2026-94294

Name of the Vulnerable Software and Affected Versions ash authentication versions 0.5.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description An authorization bypass allows an authenticated attacker to overwrite and confirm another user's email address to take over...

PT-2026-94355

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.14.0 through 4.14.x ash authentication versions 5.0.0-rc.10 through 5.0.0-rc.13 Description An improper authentication issue allows an attacker to sign in as another user by linking an OAuth2 identity to an accoun...

PT-2026-94357

Name of the Vulnerable Software and Affected Versions HUBzero CMS versions prior to 2.2.33 Description The software accepts session identifiers from query strings and request variables instead of relying exclusively on cookies. This allows unauthenticated attackers to perform session fixation,...

The vulnerability of the WSO2 platform for integrating application programming interfaces and web services lies in errors in cryptographic signatures. This allows attackers to gain unauthorized access and steal user accounts.

The vulnerability of the WSO2 platform for integrating application programming interfaces, applications, and web services is related to errors in verifying cryptographic signatures. Exploiting this vulnerability can allow an attacker to gain unauthorized access and control over user accounts...

CVE-2026-92913: Use of Insufficiently Random Values

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode in objects/functions.php derives the code entirely from uniqid sprintf'%08x%05x', seconds, microseconds...

Linux Distros Unpatched Vulnerability : CVE-2026-19607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a...

PT-2026-95131

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia Premium version versions prior to 2.4.5 Description Unauthorized access and modification of data occur due to missing ownership verification on the '/users/customers/' endpoint. Authenticat...

CVE-2026-92783 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/id endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects...

CVE-2026-92716

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary us...

CVE-2026-47094

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

WordPress GiveWP plugin 4.16.6-4.16.8.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin GiveWP versions 4.16.6-4.16.8.0...

CVE-2026-47094

SIMAC MyPHR 1.1 , a human resources management platform, is affected by an insecure direct object reference (IDOR) vulnerability in the /api/employes/put/{id} endpoint. Due to missing server-side ownership validation, an authenticated attacker can issue a PUT request with an arbitrary employee id...

EUVD-2026-80933

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

CVE-2026-47094 SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

CVE-2026-47094 SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

CVE-2026-92716 Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary us...