CVE-2026-52825

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

CVE-2026-52825: Improper Authorization

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

PT-2026-88586

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 153.0.8010.36 Description A clickjacking issue exists in TrustedWebActivities, which allows a local attacker to spoof the address bar using a co-installed application. Clickjacking is a technique wher...

CVE-2026-84807: Incorrect Privilege Assignment

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

CVE-2026-54742: Incorrect Authorization

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verifymodaction...

CVE-2026-54740: Missing Authorization

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::ishighermodoradmincheck to enforc...

CVE-2026-28176

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

EUVD-2026-57959

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176

CVE-2026-28176 involves the WordPress Booking Activities plugin (

CVE-2026-28176

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Taylsec in WordPress Plugin Booking Activities versions = 1.18.4...

CVE-2026-28176: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

PT-2026-71525

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2024-27253: Improper Authentication

IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities...

CVE-2026-17541 Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

EUVD-2026-54571

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

PT-2026-69088

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 545-5.9.2 Description Six App Widget configuration activities—IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and...

CVE-2026-47746

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and...