EUVD-2026-60939

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

CVE-2026-73189

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66634

The Modal Survey WordPress plugin (versions ≤ 2.0.2.2.3) contains an IDOR flaw allowing authenticated subscribers to access or modify objects without authorization. Patchstack reports it; no patch version or exploitation evidence is provided in the documents. Upgrade to a newer version if availab...

CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

EUVD-2026-60919

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-16309

EdoWEB (Netiket Information Technologies) versions before 780-g7 contain an authorization bypass (IDOR) allowing authenticated, low-privilege users to access functionality not constrained by ACLs, exposing confidential data. CVSS 5.3 (MEDIUM). No in-the-wild exploitation reported. Patch to versio...

CVE-2026-16309 IDOR in Netiket Information Technologies' EdoWEB

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7...

CVE-2026-75839

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

EUVD-2026-60603

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839

ArcadeDB versions ≤ 26.7.3 expose an IDOR in the Raft cluster-info endpoints (GetClusterHandler, PostBootstrapStateHandler): authenticated users lacking cross-database privileges can enumerate the server's full database registry and retrieve per-database metadata (names, transaction IDs, bootstra...

CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by luc in WordPress Plugin Modal Survey versions = 2.0.2.2.3...

PT-2026-78241

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.9 Description An issue exists where any authenticated user can enumerate account information for all users and retrieve arbitrary account details. This occurs because the users/index and users/show actions rely...

PT-2026-77206

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

PT-2026-77131

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

PT-2026-77146

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...