EUVD-2026-62492

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

BIT-KIBANA-2026-72681 Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information th...

CVE-2026-75951: Authorization Bypass Through User-Controlled Key

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

PT-2026-78450

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

PT-2026-78452

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contact id offer / contact id event instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

EUVD-2026-61098

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

CVE-2026-74009 WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73395

The WordPress plugin Booking calendar, Appointment Booking System (versions ≤ 3.2.36) has an unauthenticated IDOR flaw, discovered by Jakub Herman, allowing remote attackers to access or modify objects without authentication. CVSS 3.1 scores 6.5 (Medium) with no in-the-wild exploitation reported....

EUVD-2026-60939

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

EUVD-2026-60919

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

WordPress Forminator Forms plugin <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability discovered by se1en in WordPress Plugin Forminator versions = 1.55.0.2...

WordPress Password Protect WordPress Lite plugin <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Password Protected Post Password Update vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin PPWP versions = 1.9.20...

WordPress Online Scheduling and Appointment Booking System - Bookly plugin <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter vulnerability

WordPress Online Scheduling and Appointment Booking System - Bookly plugin = 27.7 - Authenticated Staff+ Insecure Direct Object Reference to Sensitive Information Exposure via 'paramsid' Parameter vulnerability discovered by Raihan Adi Arba in WordPress Plugin Bookly versions = 27.7...

WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure vulnerability

WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin = 1.6.12.10 - Authenticated Contributor+ Insecure Direct Object Reference to Sensitive Information Exposure vulnerability discovered by Michael Iden Mickhat - Hack The Box in WordPress Plugin Simply Schedu...

PT-2026-77082

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

CVE-2026-75106

OpnForm (open-source form builder) contains a critical vulnerability in its editable-submission secret derivation mechanism. Secrets are generated from sequential row identifiers using Hashids with an empty default salt , making them fully predictable. An unauthenticated attacker can compute vali...

WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...

CVE-2026-16046

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API...

CVE-2026-12998

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...