CVE-2026-14187

Tutor LMS WordPress plugin versions prior to 4.0.6 are affected by an Insecure Direct Object Reference (IDOR) vulnerability. The plugin fails to enforce per-object ownership checks on its course content type, allowing any authenticated user with the instructor role to read the content of private ...

CVE-2026-62283

Nezha Monitoring (a self-hostable server and website monitoring tool) versions 1.14.13–1.14.14 and 2.0.0–2.0.9 contain a cross-tenant session hijack vulnerability. Stream identifiers created by CreateStream in service/rpc/io_stream.go are not bound to their creating user, and the WebSocket endpoi...

CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...

CVE-2026-67360

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

CVE-2026-67360 Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

EUVD-2026-64059

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

CVE-2026-67360 Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

CVE-2026-66797

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

CVE-2026-73267

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

CVE-2026-73267 Clusterclaims-controller: clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no ownership check

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

CVE-2026-73267

In Red Hat's multicluster engine, the clusterclaims-controller deletes ManagedClusters based solely on clusterclaim.spec.namespace without verifying ownership. Any tenant with standard ClusterClaim permissions can delete any cluster, including the hub's local-cluster, causing a HIGH-severity (7.7...

CVE-2026-73267 Clusterclaims-controller: clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no ownership check

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

CVE-2026-73267

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

Kibana 9.2.x < 9.4.5 Incorrect Authorization (ESA-2026-82)

The version of Kibana installed on the remote host is 9.2.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-82 advisory. - Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the...

CVE-2026-14825 Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

EUVD-2026-58195

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can chan...

CVE-2026-73652 vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can chan...

AZL-95928 CVE-2026-72693 affecting package kbd 2.2.0-2

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

PT-2026-70122

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-18934

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...