CVE-2026-65463

CVE-2026-65463 affects the WordPress Masteriyo LMS plugin, versioned up to 2.3.1, with an Insecure Direct Object References (IDOR) vulnerability in Subscriber scope. The entry provides a CVSS 3.1 base score of 5.4 (Medium) with network attack vector, low attack complexity, and requires low privil...

EUVD-2026-48075

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

EUVD-2026-48221

Contributor Insecure Direct Object References IDOR in Product Slider for WooCommerce = 1.13.62 versions...

EUVD-2026-48204

Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...

CVE-2026-61946

WordPress Easy Appointments plugin

CVE-2026-59544

The CVE covers WordPress Thrive Quiz Builder plugin versions

EUVD-2026-48197

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

Oracle E-Business Suite (July 2026 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Internal Operations. Supported versions that are...

PT-2026-63922

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

Prototype Pollution

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Prototype Pollution via the Edit Fields Set process when output fields are assigned using dot-notation path setters without restricting field names. An attacker can corrupt a shared global in the ma...

EUVD-2026-42612

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration...

GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea...

UBUNTU-CVE-2026-9737

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

CVE-2026-9737

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

EUVD-2026-47775

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

CVE-2026-65013

Technical details about CVE-2026-65013 are not publicly available in the provided documents; monitor for updates.

EUVD-2026-47745

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

CVE-2026-65013 Onlook tRPC Insecure Direct Object Reference via multiple procedures

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

EUVD-2026-47687

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers...

USN-8586-1 libgphoto2 vulnerabilities

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. CVE-2026-40333 It was discovered that libgphoto2 did not properly null-terminate buffer...