CVE-2026-103491

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

CVE-2026-103491

JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw within the issue activities API . This vulnerability allows an attacker to read restricted issues that they should not have access to. The base CVSS score is 6.5 (MEDIUM) , indicati...

CVE-2026-93882 LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...

CVE-2026-93882 LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...

CVE-2026-96173 Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

CVE-2026-96173 Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

EUVD-2026-90466

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

PT-2026-103864

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references IDOR, enabling privilege escalation and the unauthorized modification or deletion of sensitive application data...

PT-2026-103875

Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...

PT-2026-103751

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

PT-2026-103890

Unauthenticated Insecure Direct Object References IDOR in WPFunnels = 3.13.1 versions...

PT-2026-103756

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...

PT-2026-105799

Impact djust.mixins.model binding.ModelBindingMixin provides a default update model event handler and is part of the LiveView base MRO, so every LiveView exposes it. It setattrs a view attribute whose name is client-supplied field, gated only by: reject -prefixed names; reject a 14-entry denylist...

CVE-2026-97251: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Bus Ticket Booking with Seat Reservation = 5.9.3 versions...

CVE-2026-100517: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...

CVE-2026-97269: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in WPFunnels = 3.13.1 versions...

CVE-2026-103496: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...

CVE-2026-103491: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

CVE-2026-91109: Authorization Bypass Through User-Controlled Key

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-93882: Authorization Bypass Through User-Controlled Key

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...