CVE-2026-83361

A vulnerability exists in the Award/PO component of Oracle Contract Lifecycle Management for Public Sector (Oracle E-Business Suite) affecting versions 12.2.3-12.2.15 . An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critic...

CVE-2026-83363

A vulnerability exists in the Award/PO component of Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite) affecting versions 12.2.3-12.2.15 . A low-privileged attacker with network access via HTTP can easily exploit this flaw to compromise the system, potentiall...

CVE-2026-101840

A vulnerability exists in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite within the Award/PO component. Affected supported versions range from 12.2.3 to 12.2.15 . A high-privileged attacker with network access via HTTP can easily exploit this vulnera...

CVE-2026-110383 WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

CVE-2026-110383

The WP E-Signature Electronic Signature Add-on for Fluent Forms plugin (versions n/a through 2.0.5 ) is vulnerable to an Authorization Bypass Through User-Controlled Key vulnerability. This issue stems from incorrectly configured access control security levels , specifically allowing for Insecure...

CVE-2026-110383 WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

CVE-2026-110378

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5...

CVE-2026-110378 WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5...

CVE-2026-110378 WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5...

EUVD-2026-102239

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5...

CVE-2026-110378

The WordPress Ninja Forms Signature Contract Add-On plugin (versions ≤ 3.2.5 ) is vulnerable to a Broken Access Control issue. This vulnerability is caused by Missing Authorization , specifically allowing for the exploitation of Incorrectly Configured Access Control Security Levels . The impact o...

WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin Ninja Forms Signature Contract Add-On versions = 3.2.5...

CVE-2026-110378: Missing Authorization

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5...

CVE-2026-109172

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in...

EUVD-2026-97376

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in...

CVE-2026-109172 yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in...

CVE-2026-109172

The yshop-crm software, versions through 2.1.3 , is vulnerable to a missing authorization flaw (CWE-862). The issue exists in the POST /admin-api/crm/contract-receivables/check endpoint, where the handler lacks a @PreAuthorize check. Furthermore, the required approver validation within CrmContrac...

CVE-2026-109171

The yshop-crm software, version 2.1.3 and below , is vulnerable to a missing authorization flaw. The root cause is that the CrmContractController lacks the @PreAuthorize annotation and has its approver checks commented out. This allows any authenticated back-office user to call the POST /admin-ap...

EUVD-2026-97375

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers ca...

CVE-2026-109171

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers ca...