WordPress Wise Chat plugin <= 3.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peng Zhou in WordPress Plugin Wise Chat versions = 3.4.1...

CVE-2026-81802

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-81802

WpEvently (WordPress plugin, also listed as Mage EventPress) versions ≤ 5.6.0 contain an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating a network-exploitable issue requiring...

EUVD-2026-72645

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

PT-2026-86991

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-86489

JetBrains YouTrack before version 2026.2.18634 contains an IDOR (Insecure Direct Object Reference) vulnerability in the user profile API , allowing an attacker with low-level privileges to disclose private issues and starred folders across organizations via the network. The CVSS 3.1 score is 6.5 ...

CVE-2026-86479

JetBrains YouTrack versions prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 are affected by a missing authorisation vulnerability that allows unauthorised access to restricted REST API resources via an IDOR (Insecure Direct Object Reference) flaw. An attacker with low-level privileges (e.g...

CVE-2026-86451

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

EUVD-2026-72396

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86451

MISP versions ≤2.5.45 contain an insecure direct object reference (IDOR) in EventGraphTool::get_reference_data(). Authenticated users could retrieve object-reference records by UUID without the system verifying that the requester had access to the parent object , allowing retrieval of reference d...

ultralytics v8.4.142

中文 | 한국어 | 日本語 | Русский | Deutsch | Français | Español | Português | Türkçe | Tiếng Việt | العربية Ultralytics creates cutting-edge, state-of-the-art SOTA YOLO models built on years of foundational research in computer vision and AI. Constan...

PT-2026-86765

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view. The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: type key data fingerprint but did n...

WordPress Live Composer – Free WordPress Website Builder plugin <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Page Builder: Live Composer versions = 2.1.18...

CVE-2026-19634 PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...

CVE-2026-86242

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...

EUVD-2026-72107

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...