37173 matches found
CVE-2026-67622
Flowise 3.1.4 OpenAI Assistants integration contains an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access credentials from other workspaces by supplying arbitrary credential UUIDs to Assistants endpoints without workspace ownership verification. Attackers c...
CVE-2026-19111
CVE-2026-19111 affects Amazon Strands Agents Tools’ memory tools (mongodb_memory, elasticsearch_memory, mem0_memory) prior to 0.8.3. The issue is an insecure direct object reference that could allow remote authenticated users to access, modify, or delete memories belonging to other tenants by pro...
CVE-2026-15147
The vulnerability CVE-2026-15147 affects the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23. The issue is an unauthenticated payment-notification bypass caused by failing to verify the payment recipient, amount, and status, and not binding the notification to the inten...
CVE-2026-66843
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...
CVE-2026-66692
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-65579
Unauthenticated PHP Object Injection in Agricola = 1.21.0 versions...
CVE-2026-65581
Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...
CVE-2026-65575
Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...
CVE-2026-65576
Unauthenticated PHP Object Injection in Adrena = 1.2.14 versions...
CVE-2026-65577
Unauthenticated PHP Object Injection in Advice = 1.18.0 versions...
CVE-2026-65578
Unauthenticated PHP Object Injection in Agora = 1.9 versions...
CVE-2026-65572
Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...
CVE-2026-65571
Unauthenticated PHP Object Injection in 69 Clothing = 1.2.11.1 versions...
CVE-2026-65573
Unauthenticated PHP Object Injection in Abelle = 1.22 versions...
CVE-2026-65574
Unauthenticated PHP Object Injection in Abogado = 1.18 versions...
CVE-2026-65552
Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...
CVE-2026-65556
Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...
CVE-2026-65549
Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...