PT-2026-147141

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user id parameter to the render button callback instead of relying on the session identity...

CVE-2026-17308

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation...

EUVD-2026-118699

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation...

CVE-2026-17308 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation...

CVE-2026-17308 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation...

CVE-2026-92704

A flaw was found in SharpEmu's debugger frontend. The local debugger interface lacks authentication and Cross-Site Request Forgery CSRF protections. A remote attacker could exploit this by tricking a user into visiting a malicious website that transmits unauthorized requests to the local service...

CVE-2026-61650

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the POST /Api/V8/module/moduleName/id/relationships/linkFieldName endpoint checks only view and list permissions before a one-to-many relationship writes a target...

CVE-2026-61650

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to an incorrect access control flaw in the POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint. The root cause is that the system verifies view and list permissions but fails to enforce the necessary edit permiss...

CVE-2026-107047

Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data...

CVE-2026-117606 NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...

CVE-2026-117606 NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...

CVE-2026-117606

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...

PT-2026-127730

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used by with the user. Attackers holding the default nexopos.use.registers permission can submit...

CVE-2026-116208 YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities durin...

CVE-2026-112287 Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy...

Krayin Laravel-CRM authorization issue vulnerability

The Krayin Laravel-CRM version 2.2.7 and earlier have a security vulnerability. This vulnerability stems from improper object-level authorization in the EmailController’s write operations. It allows authorized users with limited permissions to manipulate other users’ emails by providing digital...

CVE-2026-111660

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...

EUVD-2026-103082

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...

CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...

CVE-2026-111660

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...