24050 matches found
CVE-2025-71400 better-auth passkey before 1.4.0 IDOR via delete-passkey
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...
CVE-2025-71400
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...
CVE-2026-15248
Affected software: Meta Box WordPress plugin (WordPress) prior to 5.13.1. Vulnerability: does not verify that the user is authorized to delete the supplied attachment, enabling a low-privilege user (e.g., Contributor) to permanently delete arbitrary media attachments owned by other users. Root ca...
CVE-2026-14938
CVE-2026-14938 affects the FluentBoards WordPress plugin prior to 1.95.3. The issue: during a board import, the plugin does not verify that selected items belong to a board the requesting user is authorized to access, allowing any authenticated user with member access on a single board to copy/re...
MINI-J4JR-3668-6R8X
Bulletin has no description...
MINI-JR67-M5FG-JRM3
Bulletin has no description...
MINI-FG6R-MH34-MWJ3
Bulletin has no description...
CVE-2026-67310
OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...
CVE-2026-67310
OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...
CVE-2026-67310 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks
OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...
CVE-2025-14073
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...
EUVD-2025-210580
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...
CVE-2025-14073 WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...
CVE-2025-14073
The CVE-2025-14073 entry concerns the WooCommerce PayPal Payments plugin for WordPress (affected versions up to 3.3.2). It describes an Insecure Direct Object Reference flaw in the enqueue_paypal_insights_script_on_order_received() function caused by missing validation on a user-controlled key. T...
CVE-2025-14073
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...
Oracle Linux 8 : kernel (ELSA-2026-47011)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47011 advisory. 4.18.0-553.148.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to t...
GHSA-3WHF-VGF2-9W6G
creationtimestamp| type| source ---|---|--- 2026-07-31 20:31:22+00:00| seen| https://gist.github.com/alon710/124f7bf887e5079fb15a66958a9543ef...
CVE-2026-18321
Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd...