CVE-2026-86726 AVideo through 29.0 Information Disclosure via restreamsActive.json.php

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive...

CVE-2026-85182 vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...

CVE-2026-85182

vhr (a Java-based HR management system) through commit 03abbd3 contains a missing authorization flaw in the PUT /hr/pass endpoint. The server fails to verify that the account ID supplied in the request belongs to the authenticated caller, enabling cross-account password changes : any authenticate...

CVE-2026-85182 vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...

CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totpuserecovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownersh...

CVE-2026-18962 WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

CVE-2026-72546

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-72546 Attendize Attendize - Insecure Direct Object Reference

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-72546 Attendize Attendize - Insecure Direct Object Reference

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

EUVD-2026-56016

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-72546

Attendize CVE-2026-72546 is an insecure direct object reference in the postInviteAttendee endpoint, exploitable by any authenticated event organiser to inject attendees and orders into events owned by other accounts. The endpoint loads the target event by ID without scoping to the authenticated o...

PT-2026-70122

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-72719

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

EUVD-2026-55654

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

CVE-2026-72719 Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

CVE-2026-72719 Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

CVE-2026-72719

Chatwoot’s CVE-2026-72719 affects the Chatwoot application prior to version 4.9.0, where an authenticated account administrator could transfer resources across accounts via the writable account_id parameter. Affected resources include Portals, Automation Rules, Macros, and Twilio Channels, potent...

CVE-2026-72719 Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

CVE-2026-72719: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

EUVD-2026-53324

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...