CVE-2026-113349

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

CVE-2026-113349 OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

EUVD-2026-104920

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

CVE-2026-113349 OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

CVE-2026-113349 OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

CVE-2026-113349

OpenCATS versions prior to 0.10.0 are vulnerable to a missing authorization flaw in the CalendarUI::onEditEvent() and onDeleteEvent() functions. This vulnerability (CWE-639) allows authenticated users with EDIT or DELETE privileges to modify or remove calendar events belonging to other users by s...

PT-2026-118333

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

OpenCATS Authorization Issue Vulnerability

Versions of OpenCATS prior to 0.10.0 have an authorization issue. This vulnerability stems from the lack of authorization verification in the CalendarUI::onEditEvent and onDeleteEvent functions. Authenticated users can modify or delete calendar events for other users by providing any event ID,...

CVE-2026-60124 MISP importModule missing authorization allows read-only users to modify events via misp_standard imports

An authorization bypass in MISP’s EventsController::importModule allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the mispstandard format, the write path did not verify eve...

CVE-2026-1987 Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification

The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.1.6. This is due to the schedulerwidgetajaxsaveevent function lacking proper authorization checks and ownership verification when updating events. This makes it...

fsnotify: do not generate ACCESS/MODIFY events on child for special files

...

CVE-2025-68788

In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events e.g. INACCESS/INMODIFY, but they do allow the same user to subscri...

CVE-2025-68788

In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events e.g. INACCESS/INMODIFY, but they do allow the same user to subscri...

CVE-2025-68788 fsnotify: do not generate ACCESS/MODIFY events on child for special files

In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events e.g. INACCESS/INMODIFY, but they do allow the same user to subscri...

CVE-2025-68788

CVE-2025-68788 is addressed in OSV:OESA-2026-1305, which reports a Linux kernel security update for the fsnotify subsystem. The fix aligns fsnotify behavior with file-attrib semantics by not generating ACCESS/MODIFY events for parent watchers when a read/write occurs on special files (e.g., /dev/...

CVE-2025-68788 fsnotify: do not generate ACCESS/MODIFY events on child for special files

In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events e.g. INACCESS/INMODIFY, but they do allow the same user to subscri...

CVE-2025-68788 fsnotify: do not generate ACCESS/MODIFY events on child for special files

In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events e.g. INACCESS/INMODIFY, but they do allow the same user to subscri...

CVE-2025-68788: Exposure of Sensitive Information to an Unauthorized Actor

In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events e.g. INACCESS/INMODIFY, but they do allow the same user to subscri...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from fsnotify generating ACCESS/MODIFY sub-events for special files, which could lead to information disclosure...

CVE-2021-25084

The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for...