CVE-2026-72689

OpenSignLabs opensignserver prior to 2.37.0 is affected by a Broken Object-Level Authorization issue. The getDocument Parse cloud function fetches documents using useMasterKey, bypassing object ACLs and returning full contract records, including sender and signer PII and a pre-signed document dow...

CVE-2026-72689 OpenSignLabs opensignserver - Broken Object Level Authorization

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

CVE-2026-68131

The CVE-2026-68131 issue affects the Linux kernel RBD (block device) code. A bug in rbd_object_map_callback() could propagate a positive result code for an object-map update during a reply to an RBD request, which is invalid for writes. This prevents the intended normalization of the result code ...

CVE-2026-68131 rbd: Reset positive result codes to zero in object map update path

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...

EUVD-2026-55512

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...

CVE-2026-68131 rbd: Reset positive result codes to zero in object map update path

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...

WordPress Grand Spa theme <= 3.5.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Spa versions = 3.5.3...

WordPress Grand Car Rental theme <= 3.7.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Car Rental versions = 3.7.2...

Exploit for CVE-2026-15598

CVE-2026-15598 A weakness has been identified in antv layou...

CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-19077 Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-19077

The Duplicate Post WordPress plugin (versions before 1.5.5 ) is vulnerable to an authenticated arbitrary post deletion flaw. The root cause is a lack of per-object authorization checks during the plugin's bulk copy and delete operations. This allows any user granted access to the plugin by an adm...

CVE-2026-14211

The Booking for Appointments and Events Calendar (Amelia Pro) WordPress plugin before version 9.7 is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that an authenticated employee (provider) is authorized to access a specific customer's record. An ...

CVE-2026-14211 Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

CVE-2026-18934 RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-15238 Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

CVE-2026-15238

The MotoPress Hotel Booking (and Hotel Booking Lite ) WordPress plugin, in versions before 6.2.3 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to verify record ownership when updating customer records, which allows any authenticated user with a low-privileged ...

CVE-2026-17018 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...