CWE-639

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated em

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.6.6, 18.7 before 18.7.4, and

Nextcloud is an open source content collaboration platform. From versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appoi

wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calli

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated u

A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPor

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.

A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.s

TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine's the findResult query does not filter r

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes acces

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread pa

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/co

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an aut

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course compl

Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `get

Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-ti

A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin acc

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPre

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-pictu

The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a r

The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning p

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to acc

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before upd

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before sa

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the RE

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplic

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, al

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question ba

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order informa

Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write acce

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.7 an

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of it

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging t

An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior

Summary An Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function with

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke e

Identity based authorization bypass vulnerability (IDOR) that allows an attacker to modify the data of a legitimate user

Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that

A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/{EVENTID}/{TIME

A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a vict

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJA

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoin