CVE-2026-12274 Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-12274

CVE-2026-12274 affects the Tutor LMS WordPress plugin prior to 3.9.13. The underlying issue is that content-builder save handlers do not verify that the requesting user is authorized to edit the target post, instead authenticating only against an unrelated identifier. This allows authenticated us...

CVE-2026-12271

The CVE describes a vulnerability in the Tutor LMS WordPress plugin prior to 3.9.13 where the system does not verify ownership of the targeted quiz attempt before writing to it. This allows authenticated users with subscriber-level access and above to modify and force-complete other students’ qui...

MINI-942G-8V78-8H95

Bulletin has no description...

MINI-PPH2-V5HC-CQX8

Bulletin has no description...

MINI-36F3-HR43-VRXQ

Bulletin has no description...

MINI-53JX-P9PJ-2M68

Bulletin has no description...

MINI-V33V-384C-VPXC

Bulletin has no description...

MINI-CMRP-G767-QRGH

Bulletin has no description...

MINI-WFCW-5XCW-XH5W

Bulletin has no description...

MINI-GQQQ-5483-952X

Bulletin has no description...

MINI-7CPR-4RRJ-XG8J

Bulletin has no description...

MINI-HM6R-5353-X3F2

Bulletin has no description...

MINI-X7C3-9J46-8V68

Bulletin has no description...

MINI-XGFM-74CH-HQR7

Bulletin has no description...

MINI-CFVV-PH5J-MRV8

Bulletin has no description...

MINI-32JX-3XFG-235H

Bulletin has no description...

BIT-GITLAB-2025-12506 Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from t...

PT-2026-59571

Summary Type: Insecure Direct Object Reference. The issue CRUD endpoints GET / PATCH / DELETE /workspaces/workspace id/issues/issue id gate access on require workspace memberworkspace id only, then resolve issue id through IssueService.getissue id which is a primary-key lookup with no workspace...

PT-2026-59565

Summary Type: Insecure Direct Object Reference. The comment endpoints POST /workspaces/workspace id/issues/issue id/comments and GET .../comments gate access on require workspace memberworkspace id only, then call CommentService.createissue id=issue id, ... and CommentService.list for issueissue ...