43752 matches found
CVE-2026-81915 In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...
CVE-2026-81915 In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...
CVE-2026-81915
Concrete CMS below 9.5.3 has a missing object-level authorization check in the Types::submit() dashboard controller. When updating a Page Type, the controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), allowing a signed-in dashboard user a...
WordPress The Events Calendar plugin <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability
Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin The Events Calendar versions = 6.17.4...
CVE-2026-62113
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...
CVE-2026-62134
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...
CVE-2026-62103
Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...
CVE-2026-62105
Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...
CVE-2026-62107
Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...
WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution vulnerability
Authenticated Subscriber+ PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin Tutor LMS versions = 4.0.7...
[SECURITY] Fedora 45 Update: memcached-1.6.45-1.fc45
memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load...
EUVD-2026-76203
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...
CVE-2026-62134
An Insecure Direct Object References (IDOR) vulnerability was identified in the WordPress Starter Templates plugin (versions ≤ 4.7.5 ). The flaw allows a contributor-level authenticated user to manipulate objects they should not have access to, resulting in a low integrity impact (CVSS 4.3, MEDIU...
CVE-2026-62134 WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...
CVE-2026-62134 WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...
CVE-2026-62113
CVE-2026-62113 is an Insecure Direct Object References (IDOR) vulnerability in the WordPress plugin Slim SEO (versions
CVE-2026-62113 WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...
EUVD-2026-76207
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...