CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

EUVD-2026-72695

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.18) is vulnerable to PHP Object Injection via deserialization of untrusted input introduced through a shortcode. Authenticated attackers with contributor-level access or above can inject a PHP object. Critically, no known P...

WordPress Wise Chat plugin <= 3.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peng Zhou in WordPress Plugin Wise Chat versions = 3.4.1...

CVE-2026-81802

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

EUVD-2026-72645

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-81802

WpEvently (WordPress plugin, also listed as Mage EventPress) versions ≤ 5.6.0 contain an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating a network-exploitable issue requiring...

PT-2026-86991

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-86489

JetBrains YouTrack before version 2026.2.18634 contains an IDOR (Insecure Direct Object Reference) vulnerability in the user profile API , allowing an attacker with low-level privileges to disclose private issues and starred folders across organizations via the network. The CVSS 3.1 score is 6.5 ...

CVE-2026-86479

JetBrains YouTrack versions prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 are affected by a missing authorisation vulnerability that allows unauthorised access to restricted REST API resources via an IDOR (Insecure Direct Object Reference) flaw. An attacker with low-level privileges (e.g...

CVE-2026-86451

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

EUVD-2026-72396

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86451

MISP versions ≤2.5.45 contain an insecure direct object reference (IDOR) in EventGraphTool::get_reference_data(). Authenticated users could retrieve object-reference records by UUID without the system verifying that the requester had access to the parent object , allowing retrieval of reference d...

ultralytics v8.4.142

中文 | 한국어 | 日本語 | Русский | Deutsch | Français | Español | Português | Türkçe | Tiếng Việt | العربية Ultralytics creates cutting-edge, state-of-the-art SOTA YOLO models built on years of foundational research in computer vision and AI. Constan...

PT-2026-86765

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view. The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: type key data fingerprint but did n...