CVE-2026-84654

In Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6 ), which are included in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier), a form data binding vulnerability exists. This flaw allows an attacker capable of submitting configuration forms to modify public static fields...

CVE-2024-7956

CVE-2024-7956 is an Incorrect Authorization (CWE-863) vulnerability in Rockwell Automation DataMosaix Private Cloud , versions 7.07 and prior . A threat actor with basic user privileges can gain unauthorized access to other users' projects and modify or delete them. The CVSS v3.1 base score is 8....

CVE-2024-7956 Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...

CVE-2024-7956 Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...

EUVD-2024-55748

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...

CVE-2026-78609 Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data

Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in t...

CVE-2025-15485 Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

CVE-2025-15485 Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

EUVD-2026-70034

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14326 Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14326 Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14326

The Timetics WordPress plugin through 1.0.61 fails to enforce per-object ownership when updating appointments via its REST API . This allows users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members. The vulnerability is classified...

CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-84806

Kimai versions before 2.63.0 contain an improper authorization flaw in team access endpoints. Authenticated users holding team edit permissions combined with read-only access can send POST requests to team access endpoints to modify access control lists for customers, projects, or activities beyo...

WordPress JetStyleManager for Gutenberg plugin < 1.3.9 - Skin Deletion and Modification vulnerability

Skin Deletion and Modification vulnerability discovered by Huynh Kien Minh in WordPress Plugin JetStyleManager for Gutenberg versions 1.3.9...

CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...

CVE-2026-81428

The WC Vendors WordPress plugin (versions before 2.7.2.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify the ownership or object type of user-supplied IDs during the process of saving product variations. This allows authenticated users with the vendo...

WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability

Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...

EUVD-2026-69851

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...

EUVD-2026-69854

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...