PT-2026-103179

Unauthenticated Insecure Direct Object References IDOR in Simply Schedule Appointments = 1.6.12.31 versions...

PT-2026-103152

Contributor Insecure Direct Object References IDOR in Flexible PDF Coupons = 1.14.11 versions...

PT-2026-103226

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

PT-2026-103224

Unauthenticated Insecure Direct Object References IDOR in GiveWP = 4.16.9 versions...

PT-2026-103192

Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...

CVE-2026-97282: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Review Schema = 3.1.0 versions...

CVE-2026-97078: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Client Invoicing by Sprout Invoices = 20.8.17 versions...

CVE-2026-97074: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

CVE-2026-97066: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in GiveWP = 4.16.9 versions...

CVE-2026-96347: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...

CVE-2026-94673: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Simply Schedule Appointments = 1.6.12.31 versions...

CVE-2026-94173: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Business Directory = 6.4.27 versions...

CVE-2026-62081: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Flexible PDF Coupons = 1.14.11 versions...

CVE-2026-97079: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...

PT-2026-103178

Contributor Insecure Direct Object References IDOR in Safe SVG = 2.5.0 versions...

CVE-2026-94672: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Safe SVG = 2.5.0 versions...

PT-2026-103229

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

CVE-2026-79348

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

EUVD-2026-88608

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...