CVE-2026-14326 Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

EUVD-2026-70034

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14326 Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14326

The Timetics WordPress plugin through 1.0.61 fails to enforce per-object ownership when updating appointments via its REST API . This allows users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members. The vulnerability is classified...

CVE-2026-84806

Kimai versions before 2.63.0 contain an improper authorization flaw in team access endpoints. Authenticated users holding team edit permissions combined with read-only access can send POST requests to team access endpoints to modify access control lists for customers, projects, or activities beyo...

CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...

CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...

CVE-2026-81428

The WC Vendors WordPress plugin (versions before 2.7.2.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify the ownership or object type of user-supplied IDs during the process of saving product variations. This allows authenticated users with the vendo...

EUVD-2026-69851

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...

EUVD-2026-69854

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

WordPress JetStyleManager for Gutenberg plugin < 1.3.9 - Skin Deletion and Modification vulnerability

Skin Deletion and Modification vulnerability discovered by Huynh Kien Minh in WordPress Plugin JetStyleManager for Gutenberg versions 1.3.9...

WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability

Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...

CVE-2026-77784 Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

CVE-2026-84715 FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update

FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted request to grant themselves full server control, enablin...

CVE-2026-77125: Incorrect Authorization

A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing...

ROS-20260902-73-0001

The vulnerability in GitPython is related to the implementation or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

CVE-2026-78609: Incorrect Authorization

Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in t...

PT-2026-84709

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...

CVE-2026-77787: Missing Authorization

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...