EUVD-2026-51421

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user Subscriber and above to read the subject and full message body of every other user's support...

CVE-2026-14930

The vulnerability CVE-2026-14930 affects the JS Help Desk WordPress plugin prior to 3.1.4. The issue is in a front-end request dispatcher that performs no authorization, nonce, or ownership checks, allowing unauthenticated users to upload files (constrained to the plugin’s inert allowed extension...

CVE-2026-18029

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

EUVD-2026-49752

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-14819 Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

CVE-2026-14819

CVE-2026-14819 affects the WordPress plugin Event Tickets and Registration (prior to version 5.28.4). The issue is an improper escape of event titles in the ticket history log, enabling a Stored XSS attack that can execute in higher-privileged contexts on multisite installations. The vulnerabilit...

EUVD-2026-49699

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

PT-2026-65391

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

CVE-2026-65567

Unauthenticated Broken Access Control in Event Tickets = 5.29.0.1 versions...

CVE-2026-65567

Unauthenticated Broken Access Control in Event Tickets = 5.29.0.1 versions...

CVE-2026-65567

The vulnerability concerns the WordPress Event Tickets plugin for WordPress, affected in versions ≤ 5.29.0.1. It is described as an Unauthenticated Broken Access Control flaw, meaning unauthenticated users can access restricted functionality or data. The CVE-2026-65567 entry confirms the issue wi...

EUVD-2026-49238

Unauthenticated Broken Access Control in Event Tickets = 5.29.0.1 versions...

CVE-2026-65567 WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event Tickets = 5.29.0.1 versions...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the tickets.getMilestone process. An attacker can retrieve sensitive milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs through the...

CVE-2026-15243

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-15243

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

EUVD-2026-48560

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-15243

The CVE-2026-15243 issue affects the Apereo CAS Client where the client accepts any CA-trusted certificate for a hostname that matches the configured allowlist or regex. The underlying risk is a MITM attacker could present a any CA-signed certificate for a permitted hostname, enabling interceptio...

CVE-2026-15243 Improper Validation of Certificate in CAS Client

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-15243 Improper Validation of Certificate in CAS Client

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...