MINI-567V-67R3-8VGJ

Bulletin has no description...

MINI-Q558-F74H-8MGC

Bulletin has no description...

MINI-RVXF-7R78-78VQ

Bulletin has no description...

MINI-35Q8-W543-PX5F

Bulletin has no description...

MINI-JVV5-46HC-J59V

Bulletin has no description...

MINI-QMVJ-VC9C-8W7G

Bulletin has no description...

MINI-V9GR-58MP-7X7G

Bulletin has no description...

MINI-VCJ4-3W84-68R6

Bulletin has no description...

MINI-3XR7-JQM7-4G3Q

Bulletin has no description...

MINI-C5Q4-X94H-C697

Bulletin has no description...

MINI-PWX7-PRFM-88C8

Bulletin has no description...

MINI-C6Q6-G28W-5GPX

Bulletin has no description...

MINI-3MVF-H6W8-PFV7

Bulletin has no description...

MINI-7RJ6-XW76-Q2FJ

Bulletin has no description...

CVE-2026-17087

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-12998

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...

EUVD-2026-59929

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-18347

Summary: CVE-2026-18347 affects the Kirki WordPress plugin (Freeform Page Builder, Website Builder & Customizer) up to version 6.1.1. The root cause is an authorization bypass where the plugin fails to verify that a user is allowed to perform an action. Impact: authenticated attackers with custom...

CVE-2026-17087 WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17087

The CVE describes an authorization bypass in the WP Travel Engine – Tour Booking Plugin (Tour Operator Software) for WordPress, up to version 6.8.4. An unauthenticated attacker can view private booking billing details (customer name, email, address, phone) by binding an arbitrary booking_id to th...