PT-2026-113706

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the steps reload booking form summary panel and steps start...

CVE-2026-107371

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

CVE-2026-107371

The auth0.js library contains a vulnerability where the authorize() method fails to validate the auth_time claim in the resulting ID token against the provided maxAge parameter. This flaw allows an application to potentially process an ID token representing an authentication event that is older t...

CVE-2026-107371 Missing Verification of auth_time Claim in auth0.js

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

CVE-2026-110112

Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate th...

CVE-2026-110130

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-110112

The Dockhand application, versions before 1.0.50 , is vulnerable to a privilege escalation flaw due to a failure to validate OIDC iss, aud, nonce, and exp claims. This security weakness allows an attacker with administrator rights in a different tenant of a shared identity provider (such as Micro...

CVE-2026-110112 Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation

Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate th...

CVE-2026-110230 XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...

CVE-2026-110230

The software XBackBone versions through 3.8.2 is vulnerable to a missing authorization flaw in the POST /upload/{id}/vanity route. This vulnerability allows authenticated users to modify the upload share codes of other users by providing sequential upload IDs to the MediaController::createVanity(...

CVE-2026-110101

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2026-110131

ThriveX-Server versions through 4.0 are vulnerable to a missing authorization vulnerability (CWE-862) within the GET /api/article and /api/article/{id} endpoints. This flaw allows unauthenticated attackers to access non-public content, including unpublished drafts and soft-deleted articles . Expl...

CVE-2026-110131 ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110131 ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110131 ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110131

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

EUVD-2026-98895

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110101 Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...