PT-2026-118337

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin course editor, admin quiz editor and admin question editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with anoth...

CVE-2026-45086 Decidim: Forms admin question editor lacks authorization

Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/editquestions and reach the demographics questionnaire editor without the required administrator authorization. The...