CVE-2026-14187

Tutor LMS WordPress plugin versions before 4.0.6 are affected by an IDOR (Insecure Direct Object Reference) vulnerability. The plugin fails to enforce per-object ownership checks on its course content type, meaning any user holding the instructor role can read the content of private courses belon...

CVE-2026-30884 mdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key

mdjnelson/moodle-modcustomcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds mod/customcert:manage in any single course can read and silently overwrite certificate elements...