2774 matches found
PT-2026-77062
Name of the Vulnerable Software and Affected Versions Modal Survey versions prior to 2.0.2.2.4 Description An Insecure Direct Object Reference IDOR exists, which occurs when an application provides direct access to objects based on user-supplied input, potentially allowing unauthorized access to...
PT-2026-77203
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/product question.sql queries...
PT-2026-77204
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product review.sql queries accept...
CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure
Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...
CVE-2026-63178
Onyx Enterprise Edition (open-source AI platform) is affected by a curator-scope IDOR in its user group management API. Prior to 4.3.0 , the PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py inv...
CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure
Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...
CVE-2026-75106
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...
CVE-2026-75105
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...
CVE-2026-75106 OpnForm Editable Submission Secret Derivation via Empty Hashids Salt
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...
CVE-2026-75106 OpnForm Editable Submission Secret Derivation via Empty Hashids Salt
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...
CVE-2026-75105 phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...
CVE-2026-75105 phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...
CVE-2026-75105
phpIPAM ≤1.8.1 lacks subnet-scope checks in app/temp_share/index.php and address.php; an unauthenticated holder of any temporary share URL can enumerate the subnetId parameter to read IP records—including hostnames, DNS, MAC addresses, and notes—across all sections and subnets. Patch released in ...
EUVD-2026-60385
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...
ANT-2026-VN61PHA0 · gitea · IDOR
idor medium CVE-2026-58435 GHSA-rh79-75qm-gwjr Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-VN61PHA0: Gitea LFS Deploy-Ke...
WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...
CVE-2026-75049
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...
CVE-2026-75049
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...