Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats

Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts." In a notice publish...

CVE-2026-124471

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobinvoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments,...

CVE-2026-124471 OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobinvoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments,...

CVE-2026-124471

OpenEMR versions before 8.3.0 are susceptible to a missing authorization and IDOR vulnerability in the interface/billing/sl_eob_invoice.php component. This flaw allows any authenticated user to access and manipulate billing data for any encounter by iterating the id parameter. Attackers can read ...

CVE-2026-124471 OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobinvoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments,...

EUVD-2026-119527

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobinvoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments,...

PT-2026-139985

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl eob invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments,...

CVE-2026-124471: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows…

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobinvoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments,...

CVE-2026-94113

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain a missing authorization vulnerability in three whitelisted timesheet endpoints (get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet) that fail to enforce doctype permissions. An authenticated attacker...

CVE-2026-80339

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

CVE-2026-77758

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...

CVE-2026-77758 Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...

CVE-2026-77758 Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...

CVE-2026-17087

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17087

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-59926

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-73132

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-19088

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

CVE-2026-13610 KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration

The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff doctor account with full access to patient records, billing and clinic data...

CVE-2026-13610

The KiviCare WordPress plugin (versions prior to 4.5.2 ) is vulnerable to unauthenticated privilege escalation via its registration endpoint (POST /wp-json/kivicare/v1/auth/register). The root cause is improper privilege management (CWE-269) , where the checkRegistrationPermission function fails ...