WordPress WP Travel plugin < 12.0.2 - Unauthenticated Booking Payment State Tampering vulnerability

Unauthenticated Booking Payment State Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...

CVE-2026-13146

WP Travel is a WordPress plugin that facilitates travel booking management. Versions before 12.0.2 contain an Insecure Direct Object Reference (IDOR) flaw in the bank-deposit slip submission endpoint: the plugin does not properly verify that the requester owns the targeted booking. An unauthentic...

CVE-2026-13146 WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

Kibana 8.9.x < 8.19.19 / 9.x < 9.4.5 Missing Authorization (ESA-2026-86)

The version of Kibana installed on the remote host is 8.9.x prior to 8.19.19, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-86 advisory. - The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created th...

CVE-2026-25705

A vulnerability has been identified in Rancher's Extensions where malicious code can be injected in Rancher through a path traversal in the compressedEndpoint field inside a UIPlugin deployment. A malicious UI extension could abuse that to: Overwrite Rancher binaries or configuration to inject...

CVE-2026-25705 Rancher Extensions have arbitrary file access via path traversal

A vulnerability has been identified in Rancher's Extensions where malicious code can be injected in Rancher through a path traversal in the compressedEndpoint field inside a UIPlugin deployment. A malicious UI extension could abuse that to: Overwrite Rancher binaries or configuration to inject...

Multiplatform View State Tampering

Trustwave's SpiderLabs Security Advisory TWSL2010-001: Multiplatform View State Tampering Vulnerabilities Published: 2010-02-08 Version: 1.1 SpiderLabs has documented view state tampering vulnerabilities in three products from separate vendors. View states are used by some web application...