44134 matches found
EUVD-2026-42050
Phoenix: Presence keys colliding with Object.prototype members break existence checks...
CVE-2026-85389 Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints
Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...
CVE-2026-82023
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...
EUVD-2026-70650
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...
CVE-2026-82023 LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...
CVE-2026-82023 LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...
CVE-2026-82023
LearnPress WordPress Plugin versions before 4.4.6 are affected by a broken object-level authorization (BOLA) vulnerability in the question answer insert code path. The root cause is a missing ownership check that fails to verify whether the question belongs to the authenticated user. An attacker ...
CVE-2026-84834
Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...
CVE-2026-84836
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84769
Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...
CVE-2026-84752
Contributor PHP Object Injection in RTMKit = 2.1.5 versions...
CVE-2026-84753
Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...
WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by ChinhNguyen in WordPress Plugin SureForms versions = 2.12.5...
CVE-2026-84836 WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84834 WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...
EUVD-2026-70565
Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...
CVE-2026-84834 WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...
CVE-2026-84834
CVE-2026-84834 affects the WordPress JobSearch plugin in versions ≤ 3.2.0 . The vulnerability is an unauthenticated PHP Object Injection , allowing a remote attacker with no privileges to potentially achieve high impact on confidentiality, integrity, and availability, as reflected by a CVSS 3.1 s...
CVE-2026-84836
WC Ukraine Shipping is a WordPress plugin affected by an Insecure Direct Object References (IDOR) vulnerability in versions 1.22.3 and earlier . The flaw allows a low-privilege user (Subscriber level) to access restricted objects, resulting in high confidentiality impact and low integrity impact,...