PT-2026-85208

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary...

CVE-2026-81196

The MasterStudy LMS WordPress Plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions prior to 3.7.46 . The plugin fails to properly verify ownership of quiz question identifiers, enabling users with instructor access to view quiz questions belonging to o...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Instructor+ Quiz Answer Disclosure vulnerability

Instructor+ Quiz Answer Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

CVE-2026-81196 MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...

WordPress Quiz and Survey Master (QSM) plugin < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure vulnerability

Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Quiz And Survey Master versions 11.2.4...

CVE-2026-79615

The Quiz and Survey Master (QSM) WordPress plugin, in versions prior to 11.2.4 , contains an Insecure Direct Object Reference (IDOR) vulnerability. The root cause is a failure to perform proper authorization checks when retrieving question bank entries via specific REST API routes . This allows u...

CVE-2026-79615 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other...

GO-2026-6148 Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability in github.com/apache/answer

Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability in github.com/apache/answer...

GO-2026-6152 Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in github.com/apache/answer

Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in github.com/apache/answer...

GO-2026-6249 Apache Answer: AdminToken not invalidated after admin deactivation in github.com/apache/answer

Apache Answer: AdminToken not invalidated after admin deactivation in github.com/apache/answer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...

GO-2026-6153 Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer...

GO-2026-6151 Apache Answer vulnerable to Cross-site Scripting in github.com/apache/answer

Apache Answer vulnerable to Cross-site Scripting in github.com/apache/answer...

GO-2026-6154 Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer...

GO-2026-6147 Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability in github.com/apache/answer

Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability in github.com/apache/answer...

PT-2026-80393

Apache Answer vulnerable to Cross-site Scripting in github.com/apache/answer...

PT-2026-80394

Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in github.com/apache/answer...

PT-2026-80396

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer...

PT-2026-80392

Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability in github.com/apache/answer...

EUVD-2026-60386

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

CVE-2026-58442

The Gitea software is vulnerable to a Server-Side Request Forgery (SSRF) during repository migration. This issue stems from a multi-answer DNS allow-list bypass specifically identified in the gitea.dev component. The vulnerability allows an attacker to bypass security restrictions to perform SSRF...