CVE-2026-92421

CVE-2026-92421 affects the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin (versions 1.1.0–1.2.2 ), fixed in 1.2.3 . The vulnerability is an IDOR (Insecure Direct Object Reference) in the host profile management feature: the plugin fails to verify that the host record b...

WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin 1.1.0-1.2.2 - Hydra Host+ Host Profile Takeover vulnerability

Hydra Host+ Host Profile Takeover vulnerability discovered by Ossacip Thanh in WordPress Plugin Hydra Booking versions 1.1.0-1.2.2...

CVE-2026-92421 Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...

CVE-2026-92421 Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...

CVE-2026-44986

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teamsinvitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session base...

EUVD-2026-44699

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teamsinvitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session base...

PT-2026-60198

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.14.5 Description An issue exists where invitation tokens from create-team-invitations in teams invitations.clj are exposed. Additionally, an existing profile id is embedded in prepare-register-profile within auth.clj...

CVE-2026-44986: Improper Authentication

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teamsinvitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session base...

CVE-2025-67645 OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit endpoint. An authenticated normal user can modify the request parameters pubpid / pid to reference another user’s recor...