44813 matches found
PT-2026-68551
Name of the Vulnerable Software and Affected Versions Export User Data versions prior to 2.2.7 Description The Export User Data plugin for WordPress allows authenticated attackers with subscriber-level access and above to perform PHP Object Injection. This occurs through the deserialization of...
Malicious Package
Overview beaver-ui-object-card is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview beaver-ui-form-object is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-59240
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
CVE-2026-59240
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
CVE-2026-59240
The CVE-2026-59240 vulnerability is an IDOR in Prospero Flow CRM. Affected code path: DeleteNotificationController::delete() at GET /notification/delete/{id}. It allows any authenticated user to delete notifications belonging to any user because the target record is fetched with Notification::fin...
CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
SUSE CVE-2025-12044
Vault and Vault Enterprise "Vault" are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for +HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393...
WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure vulnerability
Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin ShopLentor versions = 3.4.5...
UBUNTU-CVE-2026-51297
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-59539
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
DEBIAN-CVE-2026-15003
A flaw was found in the GNU Binutils Binary Utilities linker. This vulnerability, a heap-buffer-overflow read CWE-125, occurs when the linker processes a specially crafted 32-bit XCOFF Extended Common Object File Format object file. An attacker could exploit this by providing a malicious file,...
CVE-2026-15003
A flaw was found in the GNU Binutils Binary Utilities linker. This vulnerability, a heap-buffer-overflow read CWE-125, occurs when the linker processes a specially crafted 32-bit XCOFF Extended Common Object File Format object file. An attacker could exploit this by providing a malicious file,...
AZL-94187 CVE-2026-15003 affecting package binutils for versions less than 2.41-13
A flaw was found in the GNU Binutils Binary Utilities linker. This vulnerability, a heap-buffer-overflow read CWE-125, occurs when the linker processes a specially crafted 32-bit XCOFF Extended Common Object File Format object file. An attacker could exploit this by providing a malicious file,...
CVE-2026-15003
A flaw was found in the GNU Binutils Binary Utilities linker. This vulnerability, a heap-buffer-overflow read CWE-125, occurs when the linker processes a specially crafted 32-bit XCOFF Extended Common Object File Format object file. An attacker could exploit this by providing a malicious file,...
CVE-2026-59539 WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
