CVE-2026-108641: Authorization Bypass Through User-Controlled Key

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded...

CVE-2026-104898: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...

EUVD-2026-78655

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated projectviewid in the task position endpoint v1 and v2...

WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability discovered by Brian Mungai in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 5.0.2...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin LatePoint versions = 5.7.2...

WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin Bookly versions = 28.4...

CVE-2026-105833

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

EUVD-2026-95020

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

EUVD-2026-94652

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

CVE-2026-105833: Insufficiently Protected Credentials

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

CVE-2026-17538 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

CVE-2026-107270

Gophish versions through 0.12.1 are vulnerable to an Insecure Direct Object Reference (IDOR) (CWE-639) vulnerability. This flaw allows authenticated users to perform an object takeover by supplying sequential IDs in POST requests to the /api/groups/, /api/templates/, /api/pages/, and /api/smtp/ e...

CVE-2026-107270: Authorization Bypass Through User-Controlled Key

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

PT-2026-107719

Name of the Vulnerable Software and Affected Versions LatePoint - Appointment Booking & Reservation plugin for WordPress versions prior to 5.7.0 Description An Insecure Direct Object Reference exists because the process step customer function relies solely on is user logged in to validate request...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftobjref: validate objref and objrefmap expressions Referring to a synproxy stateful object from the OUTPUT hook causes the kernel to crash due to infinite recursive calls: BUG: The TASK stack guard page was accessed ...

CVE-2026-11399

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-11399 Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

EUVD-2026-91917

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-105029: Authorization Bypass Through User-Controlled Key

UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an...