EUVD-2026-100901

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

CVE-2026-94261

The Sifalo Pay WordPress plugin, affecting versions 2.0 through 2.5.2 , contains an Unauthenticated Payment Confirmation Forgery vulnerability. The root cause is an authorization bypass (CWE-639) where the plugin fails to verify that a payment transaction identifier belongs to the specific order ...

CVE-2026-94261 Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitra...

CVE-2026-103425

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-103425

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.7.29 . The flaw stems from insufficient input sanitization and output escaping regarding the 'id' parameter (specifically via a shortcode attribute). This allows authentic...

CVE-2026-103425 Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

EUVD-2026-100763

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

PT-2026-114165

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1 Description An authorization bypass exists in the Agents create endpoint. The system accepts a caller-supplied Agent ID and verifies permissions only against the requested projec...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130073 advisory. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow...

CVE-2026-110851: Authorization Bypass Through User-Controlled Key

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user...

PT-2026-113590

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

PT-2026-114187

Name of the Vulnerable Software and Affected Versions Heym versions 0.0.55 through 0.0.120 Description A privilege escalation issue exists where shared collaborators can overwrite the error workflow id of a workflow. This occurs because the field is missing from OWNER ONLY EXECUTION FIELDS. An...

CVE-2026-110621: Missing Authorization

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

PT-2026-114035

🚨 CVE-2026-110593 BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send email Celery task, which compiles the user-supplied AccountEmail message body with django.template.Template. Authenticated organization members can submit template tags through POST...

PT-2026-113706

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the steps reload booking form summary panel and steps start...

CVE-2026-107371

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

CVE-2026-107371

The auth0.js library contains a vulnerability where the authorize() method fails to validate the auth_time claim in the resulting ID token against the provided maxAge parameter. This flaw allows an application to potentially process an ID token representing an authentication event that is older t...

CVE-2026-107371 Missing Verification of auth_time Claim in auth0.js

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

CVE-2026-110112

Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate th...

CVE-2026-110130

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...