CVE-2026-14847 Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment...

CVE-2026-14843

The CVE concerns the WordPress plugin Events Made Easy prior to version 3.1.4 . The vulnerability arises because the plugin does not verify that the requester is authorized to modify a targeted record during an unauthenticated data-change request; it relies on a public nonce with no per-record to...

CVE-2026-14847

The vulnerability CVE-2026-14847 affects the Paid Membership Subscriptions WordPress plugin prior to version 3.0.7. One of the plugin’s payment-related AJAX actions does not perform capability checks or nonce validation, allowing any authenticated user with Subscriber-level access or higher to di...

CVE-2026-63563

creationtimestamp| type| source ---|---|--- 2026-07-31 04:45:35+00:00| seen| https://jvn.jp/en/vu/JVNVU98759887 2026-07-31 22:00:02+00:00| seen| Telegram/lzREupovl051IH-OQxANl3xWT1ZBkl1PTRgXqKJ4p6mKnoQ 2026-08-01 00:00:11+00:00| published-proof-of-concept|...

PT-2026-66833

Name of the Vulnerable Software and Affected Versions NTPsec affected versions not specified Description A buffer overflow occurs in the Zyfer refclock component of NTPsec. This issue allows a local attacker to cause a crash of the ntpd process by triggering a buffer copy without checking the siz...

PT-2026-66743

Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.9 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers...

CVE-2026-17948

A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=516849257...

ECHO-C482-78FF-7870

Bulletin has no description...

ECHO-3C57-8009-218D

Bulletin has no description...

ECHO-964A-7743-23A9

Bulletin has no description...

ECHO-280A-0855-3539

Bulletin has no description...

ECHO-E4C7-B244-8A4C

Bulletin has no description...

ECHO-225E-8CDA-8E05

Bulletin has no description...

ECHO-605C-D281-0640

Bulletin has no description...

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-10700

IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/flowid/filename endpoint does not enforce authentication or authorization checks, allowing unauthenticated...

CVE-2026-54722

creationtimestamp| type| source ---|---|--- 2026-07-30 17:08:56+00:00| seen| https://bsky.app/profile/kynth.studio/post/3mruwkbv7zy2r 2026-07-30 18:31:07+00:00| seen| https://gist.github.com/alon710/a4455529dbdac06b73f9e7a68363941a 2026-07-30 18:35:06+00:00| published-proof-of-concept|...

SUSE CVE-2026-45692

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different...

SUSE CVE-2026-45760

Externally Controlled Reference to a Resource in Another Sphere, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the...

SUSE CVE-2026-49823

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types - Secret, ConfigMap, and Package. The first two were namespace-validated by...