EUVD-2026-105141

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7...

EUVD-2026-105131

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2...

EUVD-2026-105041

Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

CVE-2026-9589

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...

CVE-2026-113349

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

CVE-2026-113353

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admincourseeditor, adminquizeditor and adminquestioneditor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another...

CVE-2026-112785

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any...

CVE-2026-112783

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...

CVE-2026-112784

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any...

CVE-2026-112786

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported...

CVE-2026-112787

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregat...

EUVD-2026-104932

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...

CVE-2026-113353

The LearnPress plugin (versions before 4.4.10 ) is vulnerable to a missing authorization flaw in the admin_course_editor, admin_quiz_editor, and admin_question_editor lp-ajax actions. This vulnerability allows authenticated instructors to modify content belonging to other instructors by reusing t...

CVE-2026-113353 LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admincourseeditor, adminquizeditor and adminquestioneditor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another...

EUVD-2026-104924

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admincourseeditor, adminquizeditor and adminquestioneditor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another...

CVE-2026-113353 LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admincourseeditor, adminquizeditor and adminquestioneditor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another...

CVE-2026-113353 LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admincourseeditor, adminquizeditor and adminquestioneditor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another...

CVE-2026-113349 OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

EUVD-2026-104920

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

CVE-2026-113349

OpenCATS versions prior to 0.10.0 are vulnerable to a missing authorization flaw in the CalendarUI::onEditEvent() and onDeleteEvent() functions. This vulnerability (CWE-639) allows authenticated users with EDIT or DELETE privileges to modify or remove calendar events belonging to other users by s...