34244 matches found
EUVD-2026-59859
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...
CVE-2026-12905 Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...
CVE-2026-12905
The CVE-2026-12905 entry concerns the Bookly WordPress plugin (up to version 27.7). Affected component is the Mobile Staff Cabinet API, specifically appointment() in Handler1_0.php. The vulnerability is an Insecure Direct Object Reference: attacker-supplied params[id] load appointments without ve...
EUVD-2026-59850
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...
CVE-2025-10005: Authorization Bypass Through User-Controlled Key
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...
CVE-2026-13358: Authorization Bypass Through User-Controlled Key
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...
CVE-2026-12998: Authorization Bypass Through User-Controlled Key
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...
PT-2026-73130
Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.55.0.3 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. This allows unauthenticated attacker...
CVE-2026-12905: Authorization Bypass Through User-Controlled Key
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...
CodeAlpha_SecureCodingReview
Secure Coding Review — MiniBank A complete secure code review...
CVE-2026-16142 TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the addfrontuserupdate AJAX handler being registered for unauthenticated users and accepting an arbitrary truebookerwpuserid value, which is passed directly to...
EUVD-2026-59585
In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rngalg Remove sun4issrng, as it is insecure and unused: - It has multiple vulnerabilities. sun4issprngseed is missing locking and has a buffer overflow. sun4issprnggenerate fails to...
CVE-2026-74438
The CVE-2026-74438 issue concerns the Linux kernel crypto sun4i-ss RNG code, which has been removed because it was insecure and unused. The vulnerabilities include sun4i_ss_prng_seed() lacking proper locking and a buffer overflow, and sun4i_ss_prng_generate() failing to fill the full buffer due t...
CVE-2026-74438 crypto: sun4i-ss - Remove insecure and unused rng_alg
In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rngalg Remove sun4issrng, as it is insecure and unused: - It has multiple vulnerabilities. sun4issprngseed is missing locking and has a buffer overflow. sun4issprnggenerate fails to...
GHSA-MPC3-HQR8-W5F3 vulnerabilities
Vulnerabilities for packages: gnupg...
EUVD-2026-58819
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...
GHSA-H4MF-4V27-HGGJ vulnerabilities
Vulnerabilities for packages: telegraf...
CVE-2026-59733 vulnerabilities
Vulnerabilities for packages: telegraf...