CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

EUVD-2026-52287

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-9390

CVE-2026-9390 affects XML::Sig (Perl) versions before 0.71. The issue arises when verify()/_get_signed_xml() build XPath expressions by concatenating SignedInfo/Reference/@URI from the document without escaping or enforcing NCName rules. A URI containing a single quote can terminate the string li...

MINI-MM3P-G47F-975P

Bulletin has no description...

CVE-2026-57279

creationtimestamp| type| source ---|---|--- 2026-08-03 11:24:29+00:00| seen| https://jvn.jp/en/jp/JVN72334274...

CVE-2026-15260

The CVE-2026-15260 entry applies to the GEO my WP WordPress plugin prior to 4.5.5.3. The root cause is missing ownership/capability checks on two logged-in AJAX actions, enabling users with subscriber-level access or higher to modify or permanently delete geolocation records belonging to other us...

CVE-2026-15231 TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own...

Oracle Linux 10 : kernel (ELSA-2026-23329)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-23329 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

MINI-76WR-62V2-RCP6

Bulletin has no description...

CVE-2025-71400

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

MINI-XHQ9-222M-5326

Bulletin has no description...

MINI-WQRH-VVWF-6XW2

Bulletin has no description...

MINI-V76H-79J6-PQ3J

Bulletin has no description...

MINI-G226-WFR5-M4FV

Bulletin has no description...

CVE-2025-71400 better-auth passkey before 1.4.0 IDOR via delete-passkey

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

CVE-2025-71400

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

EUVD-2025-210591

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

CVE-2025-71400 better-auth passkey before 1.4.0 IDOR via delete-passkey

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

CVE-2026-15248

Affected software: Meta Box WordPress plugin (WordPress) prior to 5.13.1. Vulnerability: does not verify that the user is authorized to delete the supplied attachment, enabling a low-privilege user (e.g., Contributor) to permanently delete arbitrary media attachments owned by other users. Root ca...