PT-2026-73082

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=bookly mobile staff cabinet in frontend/modules/mobile staff cabinet/api/handlers/Handle...

CVE-2021-43716

creationtimestamp| type| source ---|---|--- 2026-08-15 08:00:08+00:00| seen| Telegram/KZva-AqPLSqOM7FFaN2xmlp5RH1as8bfWVHnuu2lh7A0hs 2026-08-15 08:00:08+00:00| seen| Telegram/fgLB1C36paZjghRukCyLhva12xDXyeSFjJghnq0Trmh6Q 2026-08-16 00:00:14+00:00| published-proof-of-concept|...

MINI-PJC9-5MFR-RPFP

Bulletin has no description...

Navidrome <=0.54.5 - Authentication Bypass in Subsonic API

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

CVE-2026-19680

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...

EUVD-2026-58743

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...

CVE-2026-19680

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...

CVE-2026-19680 SQL Injection

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...

CVE-2026-19680

CVE-2026-19680 is a SQL injection vulnerability in Security Center that could allow an attacker to access unauthorized data from the application's database. The public records show a high-severity impact with CVSS metrics indicating network access and low privileges required. Tenable’s advisory f...

CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...

CVE-2026-72655

The CVE-2026-72655 issue concerns Kibana’s case management API in Elastic Security, where Object attributes accepted by the API could be modified by an authenticated user lacking case editing privileges, due to insufficient authorization checks compared to the UI. This CWE-915 vulnerability could...

CVE-2026-72675 Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to...

EUVD-2026-57455

SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without...

CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-13612 KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

CVE-2026-73229

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render uses overridemethod to simulate GET and directly invokes view.get without view.checkpermissions while rendering an invalid write...

CVE-2026-18705

An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructin...

EUVD-2026-56024

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticat...