CVE-2026-41410

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-40520. Reason: This candidate is a duplicate of CVE-2026-40520. Notes: All CVE users should reference CVE-2026-40520 instead of this candidate...

CVE-2026-28374 IDOR in Annotations API allows unprivileged users to DELETE annotation

Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations...

CVE-2026-28374

CVE-2026-28374 corresponds to an IDOR in the Annotations API where editors can delete any annotation, including those they lack read access to. The vulnerability allows unprivileged users to delete annotations they should not be able to modify, while editor users cannot create or read annotations...

ECHO-78A2-DC43-2A07

Bulletin has no description...

SUSE CVE-2017-7499

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-8933. Reason: This candidate is a reservation duplicate of CVE-2017-8933. Notes: All CVE users should reference CVE-2017-8933 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

MINI-QXVG-J895-GPX7

Bulletin has no description...

MINI-PQQG-Q56R-9W98

Bulletin has no description...

MINI-HX2H-74JW-X39P

Bulletin has no description...

MINI-WV8R-FVWH-93X7

Bulletin has no description...

MINI-55FW-53PR-627F

Bulletin has no description...

MINI-JPM5-X4Q5-5C8Q

Bulletin has no description...

MINI-CRJM-C3X8-3558

Bulletin has no description...

MINI-58PW-XP2X-G32R

Bulletin has no description...

MINI-W763-VMFJ-RQ7W

Bulletin has no description...

MINI-M8R5-GJH7-Q3QW

Bulletin has no description...

MINI-CX37-2MJ6-JPRF

Bulletin has no description...

MINI-36MX-MR33-3QW2

Bulletin has no description...

MINI-2MMQ-FJCJ-R4FM

Bulletin has no description...

MINI-H2M2-59Q3-4786

Bulletin has no description...

CVE-2026-6965

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the getcourseidby function unconditionally trusting the user-supplied course GET parameter as the authoritative course ...