CVE-2026-14857

The WP Crowdfunding WordPress plugin versions prior to 2.2.1 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify campaign ownership, allowing any authenticated user—including those with the Subscriber role—to modify the update history of campaigns belongin...

CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

PT-2026-71003

Name of the Vulnerable Software and Affected Versions WP Crowdfunding WordPress plugin versions prior to 2.2.1 Description Authenticated users, including those with Subscriber roles, can modify the update history of campaigns they do not own and trigger notification emails to backers because the...

CVE-2025-41771: Improper Neutralization of Special Elements used in an SQL Command

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

PT-2026-71038

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2026-62420: Incorrect Authorization

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...

PT-2026-71335

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

PT-2026-71224

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description An authorization bypass allows an authenticated attacker to circumvent security restrictions of a target project during cross-project instance migrations. By using the 'POST /1.0/instances/name'...

CVE-2026-18750: Authorization Bypass Through User-Controlled Key

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

CVE-2026-66875

creationtimestamp| type| source ---|---|--- 2026-08-11 20:15:05+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01 2026-08-11 22:35:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4au4rs5yxajip 2026-08-12 00:01:42+00:00| seen|...

CVE-2026-15426

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action...

CVE-2026-15426

CVE-2026-15426 affects the WordPress plugin AcyMailing (

CVE-2026-15426 AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action...

CVE-2026-15426 AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action...

CVE-2026-69113

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

EUVD-2026-56853

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113

Cap v0.3.1 has a broken access control flaw in POST /api/video/comment that lets an authenticated user supply any videoId to comment on private videos. Impact includes injecting comments on others’ private videos, triggering owner notification emails, and enumerating valid video IDs via response ...