EUVD-2026-107062

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

CVE-2026-107128 Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...

CVE-2026-107128

The Uncanny Toolkit for LearnDash WordPress plugin (versions before 3.8.2 ) is vulnerable to an Admin+ Cross-Site Account Lockout due to a missing authorization check. Specifically, the plugin fails to verify if an acting user has permission to manage targeted accounts when changing their verific...

CVE-2026-107128 Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...

CVE-2026-105998 Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

CVE-2026-105998

The Booking Package WordPress plugin (versions before 1.7.31 ) is vulnerable to an unauthenticated subscription deactivation due to missing authorization and validity checks. An unauthenticated attacker can trigger a reset of the plugin's premium subscription state, effectively disabling the plug...

CVE-2026-105998 Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

CVE-2026-24134-PoC

CVE-2026-24134-PoC Overview This repository contains the Proof of Concept PoC for CVE-2026-24134 , a Broken Object Level Authorization BOLA vulnerability in StudioCMS. Contents cve202624134poc.py - Python exploitation script Prerequisites StudioCMS=0.1.1 pip install requests colorama Quick Start...

CVE-2026-26417

CVE-2026-26417 Broken Access Control in Password Reset Functionality Vulnerability Summary A broken access control vulnerability was identified in Tata Consultancy Services TCS – Cognix Recon Client v3.0. The issue allowed authenticated users to reset passwords of arbitrary user accounts by...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - Missing Authorization to Arbitrary Options Update Subscriber+ Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2024-10542

Poc Of CVE-2024-10542 and CVE-2024-10781 Broken Authentication in Spam protection, AntiSpam, FireWall by CleanTalk Plugin = 6.43.2 Disclaimer: The information provided in this document regarding for CVE-2024-10542 is for learning and educational purposes only. We do not encourage or authorize the...

CVE-2026-5724

Summary The Temporal frontend service does not enforce authentication on streaming gRPC RPCs. The streaming interceptor chain omits the authorization interceptor, allowing unauthenticated callers to access AdminService/StreamWorkflowReplicationMessages, a privileged admin-only endpoint that strea...

CVE-2026-114089

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/ mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then...

CVE-2026-114078

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's...

CVE-2026-114079

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can...

CVE-2026-114082

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114077

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deploymen...

CVE-2026-114075

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to creat...

CVE-2026-114067

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

CVE-2026-114069

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGERSECRETKEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key c...