EUVD-2026-41260

The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.7.6 via the appointmentkey parameter due to the appointment editkey — the sole authorization token consumed by tryCance...

CVE-2026-14090

creationtimestamp| type| source ---|---|--- 2026-07-02 07:52:07+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-49088

creationtimestamp| type| source ---|---|--- 2026-07-02 07:33:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnjcw7lzb2m 2026-07-02 13:50:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpo6flfadf2t...

CVE-2026-5348 Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the '/topics' REST API endpoint being registered with a permission callback set to 'returntrue',...

EUVD-2026-41244

The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs and Off Canvas widget's template rendering in versions up to, and including, 1.4.26. The render method of the Tabs...

MINI-PGM7-2XFC-3C2P

Bulletin has no description...

MINI-Q2FG-C2PV-4222

Bulletin has no description...

MINI-V8CV-6V99-M3WW

Bulletin has no description...

MINI-986F-CR44-H249

Bulletin has no description...

MINI-686V-P2Q2-6JHC

Bulletin has no description...

MINI-9524-PW68-G44M

Bulletin has no description...

MINI-G8XP-HMCQ-RV44

Bulletin has no description...

MINI-3H84-4HGV-3F4P

Bulletin has no description...

MINI-F4C8-3HXQ-7PQG

Bulletin has no description...

MINI-HFW6-6P2R-F3FP

Bulletin has no description...

MINI-338M-4WH4-9PQM

Bulletin has no description...

MINI-HF4W-RXQC-XRWF

Bulletin has no description...

WordPress MotoPress Appointment Booking plugin <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter vulnerability

Unauthenticated Insecure Direct Object Reference to 'paymentdetails.bookingid' Parameter vulnerability discovered by g0wthr in WordPress Plugin MotoPress Appointment Booking versions = 2.4.4...

PT-2026-55488

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.31 PHP versions 8.3.0 through 8.3.31 PHP versions 8.4.0 through 8.4.22 PHP versions 8.5.0 through 8.5.7 Description The OpenSSL extension contains a buffer allocation flaw in the AES-WRAP-PAD algorithm...

CVE-2026-12657: Authorization Bypass Through User-Controlled Key

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.2 via the 'serviceid' parameter due to missing validation on a user controlled key. This makes it possible for...