CVE-2026-86839 Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

WordPress Online Scheduling and Appointment Booking System plugin < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion vulnerability

Staff+ Appointment and Payment Disclosure, Modification and Deletion vulnerability discovered by Vũ Quang Huy in WordPress Plugin Bookly versions 28.3...

CVE-2026-86839 Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-86839: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

EUVD-2026-87793

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...

CVE-2026-72662

Kibana versions 8.x (8.0.0 to 8.19.21) and 9.x (9.4.0 to 9.4.5) are vulnerable to an Authorization Bypass Through User-Controlled Key (CWE-639). This flaw allows an authenticated user with Timeline feature privileges within a Kibana space to bypass Access Control Lists (ACLs) to enumerate, read, ...

CVE-2026-100614

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...

CVE-2026-100629

A flaw was found in Capgo backend. This vulnerability allows an authenticated administrator to perform unauthorized role modifications and demote higher-privileged accounts. When updating role bindings, the application validates the rank of the newly assigned role against the caller's privileges,...

EUVD-2026-87709

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...

CVE-2026-96532

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing...

CVE-2026-96532

The Testimonials Widget WordPress plugin, versions through 4.0.4 , is vulnerable to an unauthenticated arbitrary post update vulnerability. The root cause is a failure to perform capability or ownership checks when processing the plugin's front-end testimonial submission form. This flaw allows un...

EUVD-2026-87540

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing...

WordPress MCP Server for WordPress plugin < 1.8.2 - Contributor+ Workflow Modification and Deletion vulnerability

Contributor+ Workflow Modification and Deletion vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...

CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

CVE-2026-100540

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

PT-2026-99285

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.244.1 Description A cross-tenant integrity issue exists in the metadata-cleaning worker. The worker trusts image object keys from mutable database rows without validating ownership, acting as a confused deputy. An...

CVE-2026-100540: Incorrect Authorization

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

openSUSE 16 Security Update : cjose (openSUSE-SU-2026:21944-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21944-1 advisory. - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap- based buffer overflow bsc1279844. -...