25024 matches found
CVE-2026-13116
CVE-2026-13116 affects the PDF Invoices & Packing Slips for WooCommerce plugin (WordPress) ≤ 5.14.0. Issue: Insecure Direct Object Reference via generate_document_shortcode caused by missing validation on a user-controlled key. Consequence: authenticated attackers with contributor+ access can min...
CVE-2026-49394
creationtimestamp| type| source ---|---|--- 2026-07-11 02:54:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdnxgp6ki2c...
MINI-77VF-47WV-8C8G
Bulletin has no description...
MINI-52V4-QC9M-H4X3
Bulletin has no description...
MINI-5J6F-MH3H-F2GM
Bulletin has no description...
MINI-R552-H7WG-QC3Q
Bulletin has no description...
MINI-M83P-62FH-MJ9G
Bulletin has no description...
MINI-87RC-V2PX-GQX2
Bulletin has no description...
PT-2026-57388
Name of the Vulnerable Software and Affected Versions PDF Invoices & Packing Slips for WooCommerce versions prior to 5.14.1 Description An Insecure Direct Object Reference IDOR exists in the generate document shortcode function due to missing validation on a user-controlled key. Authenticated...
CVE-2026-13232
This CVE concerns Drupal Advanced Content Feedback (admin_feedback). Affected: versions 0.0.0–2.8.0. Root cause: incorrect authorization, failing to sufficiently verify authorization over the targeted feedback record during comment processing. Impact: potential access bypass/IDOR, enabling forcef...
CVE-2026-55880 OpenReplay: Cross-user IDOR in notes and dashboard widgets
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...
CVE-2026-55880 OpenReplay: Cross-user IDOR in notes and dashboard widgets
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...
MINI-VCRV-V854-5MJ3
Bulletin has no description...
MINI-VJR5-CFV7-2F73
Bulletin has no description...
MINI-QPP8-CRPR-HJ9F
Bulletin has no description...
MINI-7VPJ-2C6V-V77R
Bulletin has no description...
MINI-HJ8P-PGWW-8W8C
Bulletin has no description...
MINI-8739-QQCF-FW6R
Bulletin has no description...