CVE-2026-59539: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

PT-2026-64934

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

GHSA-H3RM-78G3-J7CP @better-auth/stripe: cross-organization billing tampering in organization subscription actions

Am I affected? You are affected if all of these are true: - You use @better-auth/stripe from version 1.4.11 up to a patched version below. This covers the stable line through 1.6.20 and every 1.7.0 beta through 1.7.0-beta.9. - The Stripe plugin has subscriptions turned on subscription.enabled:...

CVE-2026-65696

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can...

CVE-2026-65696

Overseerr

CVE-2026-65696 Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can...

CVE-2026-65696 Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can...

CVE-2026-65696

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can...

CVE-2026-65696 Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can...

WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Paid Member Subscriptions versions = 3.0.7...

PT-2026-64027

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...