CVE-2026-16057

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

CVE-2026-15260

The GEO my WP WordPress plugin (versions prior to 4.5.5.3 ) is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The application fails to perform adequate ownership or capability checks on two specific logged-in AJAX actions. This allows authenticated users with subscriber-l...

CVE-2026-16057

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

CVE-2026-16057

The Contest Gallery WordPress plugin (versions prior to 30.0.7 ) is vulnerable to arbitrary post deletion due to the post_cg_youtube_delete_from_library handler. The plugin fails to perform per-object capability or nonce checks , relying instead on a coarse role-membership test. This allows any u...

CVE-2026-16057 Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

CVE-2026-16057 Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

EUVD-2026-52162

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

PT-2026-67069

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs...

PT-2026-67341

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-68980: Incorrect Authorization

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

CVE-2026-69082: Cross-Site Request Forgery (CSRF)

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-16057: Missing Authorization

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

PT-2026-67090

Name of the Vulnerable Software and Affected Versions The Contest Gallery WordPress plugin versions prior to 30.0.7 Description Insufficient per-object capability and nonce checks in a post-deletion handler allow users with Author-level permissions or higher to permanently delete arbitrary posts,...

PT-2026-67415

Admidio before 5.0.11 does not validate the adm csrf token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delet...

CVE-2026-10774 PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, netkeyscreate imports the Private Beacon Key into a PSA key slot under CONFIGBTMESHPRIVBEACONS enabled by default, but subnetkeysdestroy guarded the matchin...

CVE-2025-71400

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

CVE-2025-71400

CVE-2025-71400 affects better-auth passkey up to version 1.3.x (before 1.4.0). The vulnerability is an insecure direct object reference in the delete-passkey endpoint that allows authenticated users to delete arbitrary passkeys by ID, enabling attackers with valid sessions to remove other users’ ...

CVE-2025-71400 better-auth passkey before 1.4.0 IDOR via delete-passkey

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

CVE-2025-71400 better-auth passkey before 1.4.0 IDOR via delete-passkey

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

EUVD-2025-210591

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...