CWE-639

1,777 vulnerabilities with CWE-639

CVE-2026-1206 MEDIUM

Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

CVSS 4.3

CVE-2026-34055 HIGH

OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification

CVSS 8.1

CVE-2026-33934 MEDIUM

OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures

CVSS 4.3

CVE-2026-33931 MEDIUM

OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access

CVSS 6.5

CVE-2026-32120 MEDIUM

OpenEMR has IDOR in Fee Sheet Product Save

CVSS 6.5

CVE-2026-33724 HIGH

n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no

CVSS 7.4

CVE-2026-33663 MEDIUM

n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition

CVSS 6.5

CVE-2026-32535 MEDIUM

WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability

CVSS 6.5

CVE-2026-32533 MEDIUM

WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability

CVSS 6.5

CVE-2026-2414 CRITICAL

HYPR Server 9.5.2-10.7.2 - Privilege Escalation via User-Controlled Key

CVSS 9.8

CVE-2026-33511 CRITICAL

pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad

CVSS 9.8

CVE-2026-33345 MEDIUM

solidtime vulnerable to IDOR in private projects

CVSS 6.5

CVE-2026-33160 MEDIUM

Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL

CVSS 5.3

CVE-2026-33158 MEDIUM

Craft CMS < 4.17.8 and 5.9.14 - Private Asset IDOR

CVSS 6.5

CVE-2026-33700 MEDIUM

Vikunja <2.2.1 Link Share Delete - Insecure Direct Object Reference

CVSS 4.9

CVE-2026-33678 HIGH

Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

CVSS 8.1

CVE-2026-33313 MEDIUM

Vikunja <2.2.0 Task Comments - Insecure Direct Object Reference

CVSS 4.3

CVE-2026-33484 HIGH

Langflow has Unauthenticated IDOR on Image Downloads

CVSS 7.5

CVE-2026-32300 HIGH

Connect-CMS 1.x-1.41.0/2.x-2.41.0 - Privilege Escalation

CVSS 8.1

CVE-2026-23488 MEDIUM

Blinko: multiple interfaces in the comment feature allow unauthorized access

CVSS 5.3

CVE-2026-23487 MEDIUM

blinko < 1.8.4 - Unauthenticated IDOR via User Detail Endpoint

CVSS 6.5

CVE-2026-30886 MEDIUM

QuantumNous New API < 0.11.4-alpha.2 - Video Task Insecure Direct Object Reference

CVSS 6.5

CVE-2026-33297 CRITICAL

AVideo <26.0 setPassword.json.php - Channel Password Bypass

CVSS 9.1

CVE-2026-4563 MEDIUM

MacCMS Member Order Detail User.php order_info authorization

CVSS 4.3

CVE-2026-4549 LOW

mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization

CVSS 3.1