CWE-639

1,777 vulnerabilities with CWE-639

CVE-2026-5875 MEDIUM

Google Chrome <147.0.7727.55 - UI Spoofing

CVSS 4.3

CVE-2026-35478 HIGH

InvenTree has Arbitrary API Token Creation

CVSS 8.3

CVE-2026-35165 MEDIUM

LORIS has incorrect access checks in document_repository

CVSS 6.3

CVE-2026-34985 MEDIUM

LORIS has incorrect access checks in media module

CVSS 6.3

CVE-2026-32589 HIGH

Mirror-registry: quay: insecure direct object reference in blobupload

CVSS 7.4

CVE-2026-35023 MEDIUM

Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php

CVSS 4.3

CVE-2026-39616 MEDIUM

WordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability

CVSS 5.3

CVE-2026-39526 MEDIUM

WordPress WpStream plugin < 4.11.2 - Insecure Direct Object References (IDOR) vulnerability

CVSS 5.4

CVE-2026-39510 LOW

WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability

CVSS 2.7

CVE-2026-4654 MEDIUM

Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter

CVSS 5.3

CVE-2026-4330 MEDIUM

Blog2Social: Social Media Auto Post & Scheduler < 8.8.3 - Authorization Bypass

CVSS 4.3

CVE-2026-5167 MEDIUM

Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint

CVSS 5.3

CVE-2026-39374 MEDIUM

Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint

CVSS 6.5

CVE-2026-39354 MEDIUM

Scoold <1.66.2 POST /questions/ask - Question Overwrite

CVSS 6.5

CVE-2026-39331 HIGH

ChurchCRM <7.1.0 Family API - Authorization Bypass

CVSS 8.1

CVE-2026-39384 HIGH

FreeScout Customer Merge Cross-Mailbox Authorization Bypass

CVSS 7.6

CVE-2026-35584 MEDIUM

FreeScout <1.8.212 Open Tracking Endpoint - Insecure Direct Object Reference

CVSS 6.5

CVE-2026-35489 HIGH

Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`

CVSS 7.3

CVE-2026-5465 HIGH

Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter

CVSS 8.8

CVE-2026-35183 HIGH

Brave CMS <2.0.6 Article Image Deletion - Insecure Direct Object Reference

CVSS 7.1

CVE-2026-35173 MEDIUM

Chyrp Lite <2026.01 Post Model - Insecure Direct Object Reference

CVSS 6.5

CVE-2026-35045 HIGH

Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification

CVSS 8.1

CVE-2026-34444 CRITICAL

Lupa <=2.6 getattr and setattr - Sandbox Escape

CVSS 10.0

CVE-2026-31150 MEDIUM

Kaleris YMS 7.2.2.1 - Incorrect Access Control

CVSS 4.3

CVE-2026-4896 HIGH

WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation

CVSS 8.1