IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' build jobs. This occurs due to improper access control on log retrieval and unauthenticated build endpoints.
CVE-2026-14310 is a vulnerability in the Tutor LMS WordPress plugin before version 4.0.0. It allows authenticated users with subscriber-level access or higher to bypass authorization checks and access Q&A threads of courses they are not enrolled in. These users can also inject replies into those threads. The issue is due to improper verification of user access rights to the course associated with a Q&A thread.
A vulnerability in the Essential Addons for Elementor WordPress plugin before version 6.6.10 allows unauthenticated users to bypass authorization checks in the product-comparison feature. This flaw permits disclosure of the title, price, and SKU of WooCommerce products that are in draft, pending, or private status, which are normally not publicly visible.
A vulnerability in the Eventin WordPress plugin before version 4.1.16 allows unauthenticated users to create orders with an attacker-supplied status marked as paid without completing any payment. This is due to improper authorization during order creation.
CVE-2026-13145 is a medium severity vulnerability in the WP Travel WordPress plugin before version 11.8.1. It allows any logged-in user to access another customer's booking details, including billing address information, by supplying an arbitrary booking identifier. This occurs because the plugin does not verify that the booking requested on the customer account dashboard belongs to the current user.
RegistrationMagic WordPress plugin versions before 6.0.9.4 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to overwrite form submissions and profile fields of non-administrator WordPress accounts due to missing authorization, ownership, or nonce checks on front-end submission editing.
RegistrationMagic WordPress plugin versions before 6.0.9.4 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to read other users' form submission data by exploiting improper validation of a one-time password in a cookie. The vulnerability exposes personal information without requiring user interaction or privileges.
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.
The MasterStudy LMS WordPress Plugin for Online Courses and Education is affected by an insecure direct object reference vulnerability in all versions up to and including 3.7.14. This vulnerability allows authenticated users with Instructor-level access or higher to delete arbitrary attachments belonging to any user by exploiting a lack of ownership validation in the deletion function. The issue arises from the stm_lms_delete_cover() function not verifying the ownership of the file_id parameter before calling wp_delete_attachment().
The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin before 3.12.28 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped. A malicious operator could block or delete any other operator's host, or read any operator's hosts and networks. This issue has been fixed in version 0.3.6.
The "quick setup" view presented to users after they first create an
event allows to set up the most critical parts of an event in just a few
clicks. This view did not properly check that the user has permission
to change configuration for the given event. An attacker could use a
well-timed request to create products, quotas, set bank transfer
configuration, or connect a stripe account to an event they do not have
access to.
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to read arbitrary wp_options rows — including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records — whose values are stored as arrays-of-arrays containing 'title' keys, enabling cross-plugin data leakage.
The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the ":organizationId" in the URL, but the repository write filters on tag.id alone, so the URL-level org scope never reaches the database. This issue has been patched in version 26.5.0.
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.
This issue affects :
* Devolutions Server 2026.2.4.0 through 2026.2.12.0
* Devolutions Server 2026.1.23.0 and earlier
In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.