24969 matches found
CVE-2026-16797
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...
CVE-2026-16797 ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...
CVE-2026-16797
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement for WordPress (plugin) is affected up to version 3.4.5 by an Insecure Direct Object Reference via the optionSection parameter. The flaw arises from missing validation on a user-controlled key, enabling authenticated attackers with con...
EUVD-2026-49632
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
PT-2026-65504
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...
The vulnerabilities of the functions bfq_put_stable_ref() and bfq_exit_icq_bfqq() in the block/bfq-iosched.c module support the block-level kernel support in the Linux operating system. These vulnerabilities allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerabilities of the functions bfqputstableref and bfqexiticqbfqq in the block/bfq-iosched.c module are related to the reuse of previously freed memory due to competitive access to resources during the “race condition”. Exploiting these vulnerabilities can allow attackers to compromise the...
kernel security update
6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...
CVE-2026-59240
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
CVE-2026-59240
The CVE-2026-59240 vulnerability is an IDOR in Prospero Flow CRM. Affected code path: DeleteNotificationController::delete() at GET /notification/delete/{id}. It allows any authenticated user to delete notifications belonging to any user because the target record is fetched with Notification::fin...
CVE-2026-59240
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
CVE-2026-64541 net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...
EUVD-2026-49592
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...
MINI-95GQ-J7JJ-V6W9
Bulletin has no description...
MINI-2VWV-9GX5-CXRV
Bulletin has no description...
MINI-R73H-RX98-4M9G
Bulletin has no description...
MINI-CWC3-Q264-MX6V
Bulletin has no description...