CVE-2026-112823

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25...

CVE-2026-112823

The WP User Manager WordPress plugin (versions n/a through 2.9.25 ) is vulnerable to a Broken Access Control issue. This Missing Authorization vulnerability (CWE-862) allows an attacker to manipulate user states . While the vulnerability is reachable over the network with low complexity, it requi...

CVE-2026-112823 WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25...

EUVD-2026-105142

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25...

PT-2026-118422

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.26 Description A missing authorization flaw in the wp-user-manager plugin allows for the manipulation of user states. Recommendations Update to version 2.9.26 or later...

CVE-2026-13138 Improper Authorization in Divasoft Software's Biletiva Ticketing Platform

Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23...

CVE-2026-13138

The Biletiva Ticketing Platform by Divasoft Software and E-Commerce Inc. is vulnerable to a Client-Side Enforcement of Server-Side Security (CWE-602) issue. This vulnerability allows for Manipulating State , potentially compromising the integrity of the application. The issue affects versions up ...

CVE-2026-105893

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1...

EUVD-2026-94954

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1...

CVE-2026-105893

The Liquid Web / StellarWP Event Tickets plugin (version 5.30.0.1 and earlier) is vulnerable to an Authorization Bypass caused by a User-Controlled Key vulnerability. This flaw allows for the manipulation of User-Controlled Variables , potentially leading to unauthorized access. The CVSS 3.1 scor...

CVE-2026-105893 WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1...

CVE-2026-105893: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1...

Rocky Linux 8 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-libs / etc (crlsa-2021_4042)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214042 advisory. flatpak: Sandbox bypass via recent VFS-manipulating syscalls CVE-2021-41133 Tenable has extracted the preceding description block directly from the CIQ security...

CVE-2026-28145: Insufficient Verification of Data Authenticity

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39...

UBUNTU-CVE-2026-54272

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType classifies an address by matching it against a table of known IPv6...

CVE-2026-42744: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Manipulating Hidden Fields.This issue affects Ads by WPQuads: from n/a through = 3.0.2...

CVE-2026-9438

A vulnerability was found in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file courseDel.php. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from...

CVE-2026-7200

The CVE-2026-7200 issue affects SourceCodester Pharmacy Sales and Inventory System 1.0. Affected functionality is in /index.php?page=types, where manipulating the argument ID enables cross-site scripting. The vulnerability can be exploited remotely and exploits have been published. No remediation...

CVE-2026-6200

A vulnerability was determined in Tenda F456 1.0.0.5. The affected element is the function formwebtypelibrary of the file /goform/webtypelibrary. This manipulation of the argument menufacturer/Go causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been public...

CVE-2026-5413

A vulnerability was identified in Newgen OmniDocs up to 12.0.00. Affected by this vulnerability is an unknown functionality of the file /omnidocs/GetWebApiConfiguration. The manipulation of the argument connectionDetails leads to information disclosure. The attack is possible to be carried out...