EUVD-2026-71933

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-63040 Apache InLong: Missing authorization in StreamSource forceDelete

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache...

SUSE CVE-2026-22253

Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. The vulnerable code path...

GHSA-6JM8-X3G6-R33J Soft Serve is missing an authorization check in LFS lock deletion

LFS Lock Force-Delete Authorization Bypass Summary An authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. The vulnerable code path processes force deletions before...

Soft Serve is missing an authorization check in LFS lock deletion

LFS Lock Force-Delete Authorization Bypass Summary An authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. The vulnerable code path processes force deletions before...

WatchDek Social Networking XSRF (Force Delete Victim Inbox)

Exploit for php platform in category web applications + Exploit Title: WatchDek Social Networking XSRF Vulnerability Force Delete Victim Inbox + Author : ^Xecuti0n3r + E-mail : xecutioneryahoo.com + Category : Web Apps XSRF + App website: watchdek.com All you have to do is save the below code as...

Watchdek Force Delete Cross Site Request Forgery

Exploit Title: WatchDek Social Networking XSRF Vulnerability Force Delete Victim Inbox + Author : ^Xecuti0n3r + Date : 7.04.2011 + Hour : 13:37 PM + E-mail : xecutioneryahoo.com + Category : Web Apps XSRF + App website: watchdek.com All you have to do is save the below code as exploit.html Then...