EUVD-2026-50271

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

CVE-2026-5060

The CVE describes a vulnerability in the MasterStudy LMS WordPress Plugin (for Online Courses and Education) version up to 3.7.14. The issue is an Insecure Direct Object Reference in the stm_lms_delete_cover() function, which lacks ownership validation on the file_id parameter before calling wp_d...

CVE-2026-5060 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

CVE-2026-64345

A flaw was found in the Linux kernel's USB printer gadget driver. The printeropen function incorrectly increments a reference counter even when the device is already in use and the open operation fails. This prevents the reference from being properly released, leading to a permanent leak of syste...

CVE-2026-58161

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

CVE-2026-64499

A flaw was found in the Linux kernel's ti-ads1119 Analog-to-Digital Converter ADC driver. This vulnerability occurs during the buffer pre-enable process, where a Power Management PM reference is not properly released if an I2C communication error occurs. This oversight can lead to a resource leak...

CVE-2026-63241

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-63230

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

GHSA-WG2Q-39H6-66X9

creationtimestamp| type| source ---|---|--- 2026-07-29 06:32:35+00:00| seen| https://gist.github.com/alon710/9b6eb86646df2d26df9c07ebf0051d99...

CVE-2026-64534

A flaw was found in the Linux kernel's NVMe over TCP target nvmet-tcp implementation. When a data digest mismatch is detected, nvmetrequninit is called unconditionally, but if the command was already in the INITFAILED state, the matching percpureftrygetlive was never performed. The resulting...

EUVD-2026-50136

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-63241

Koollab LMS is affected by an insecure direct object reference vulnerability that allows an authenticated user to query the course completion progress of other users without proper authorization, leading to disclosure of private learning progress information. The root cause is an insecure direct ...

CVE-2026-63241

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-63241 Insecure direct object reference vulnerability

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-63241 Insecure direct object reference vulnerability

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

BELL-CVE-2026-64474

Bulletin has no description...

BELL-CVE-2026-64494

Bulletin has no description...

GHSA-WHMM-QJ9R-WVR2

creationtimestamp| type| source ---|---|--- 2026-07-29 05:32:47+00:00| seen| https://gist.github.com/alon710/7cdf75a52c50aebac3f872ab5cf7bfbf...

PT-2026-65712

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

EUVD-2025-210526

An Insecure Direct Object Reference IDOR in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request...