29216 matches found
CVE-2026-14871
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...
EUVD-2026-45186
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...
CVE-2026-14871
This CVE affects osTicket versions 1.18.3 and 1.17.7, where a Broken Object Level Authorization (BOLA) leads to an Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem. The issue enables cross-department data disclosure due to improper access controls on object referenc...
CVE-2026-14871 osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...
CVE-2026-14871 osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...
MINI-R88R-7M75-P2J9
Bulletin has no description...
MINI-3225-G9HP-39WM
Bulletin has no description...
MINI-Q8VC-639F-CHGW
Bulletin has no description...
MINI-477R-2XJ4-92WH
Bulletin has no description...
MINI-F2VX-226H-5C7M
Bulletin has no description...
MINI-864G-6RJH-77CH
Bulletin has no description...
MINI-W79R-M6CC-JJ59
Bulletin has no description...
MINI-HMQ4-86VC-7VX3
Bulletin has no description...
MINI-JW83-RW2V-R5RX
Bulletin has no description...
MINI-JXWH-6774-G7H9
Bulletin has no description...
MINI-RHJC-Q57R-JCV5
Bulletin has no description...
CVE-2026-12393 WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR
The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders...
CVE-2026-15159
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheetexportformid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...
K000162310: Linux kernel vulnerability CVE-2026-46316
Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgicitsinvalidatecache walks the per-ITS translation cache with xaforeach and drops the cache's reference on each...