CVE-2026-15248

The Meta Box WordPress plugin (versions before 5.13.1 ) contains an Insecure Direct Object Reference (IDOR) vulnerability due to a lack of authorization checks. This flaw allows users with low-privilege roles, such as Contributor , to bypass permission checks and permanently delete arbitrary medi...

CVE-2026-14938

The FluentBoards WordPress plugin (versions before 1.95.3 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify that items selected during a board import operation belong to a board the requesting user is authorized to access. This allows any authenticated...

MINI-RMQ6-GRQV-XQ7R

Bulletin has no description...

MINI-6F7V-749R-4VPV

Bulletin has no description...

MINI-JVM3-CV2J-335J

Bulletin has no description...

MINI-H57M-F6H8-6QMP

Bulletin has no description...

MINI-92V3-FMRW-JHP2

Bulletin has no description...

MINI-QFHC-RXXW-8WGR

Bulletin has no description...

MINI-F98J-4736-VMJH

Bulletin has no description...

MINI-PV2H-JQVM-4WM3

Bulletin has no description...

MINI-J4JR-3668-6R8X

Bulletin has no description...

MINI-Q2MR-J462-XXRW

Bulletin has no description...

MINI-JR67-M5FG-JRM3

Bulletin has no description...

MINI-FG6R-MH34-MWJ3

Bulletin has no description...

MINI-4MMC-CF9X-86XM

Bulletin has no description...

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-67310 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-67310 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2025-14073

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...