CWE-639

1,571 vulnerabilities with CWE-639

CVE-2026-1947 HIGH

NEX-Forms WordPress Plugin <=9.1.9 - Insecure Direct Object Reference

CVSS 7.5

CVE-2026-1883 MEDIUM

Wicked Folders <4.1.0 - Insecure Direct Object Reference

CVSS 4.3

CVE-2026-3999 HIGH

Broken access control vulnerability affecting ID Server

CVE-2026-2888 MEDIUM

Formidable Forms WordPress Plugin <=6.28 - Auth Bypass

CVSS 5.3

CVE-2026-2879 MEDIUM

GetGenie WordPress Plugin <=4.3.2 - Insecure Direct Object Reference

CVSS 5.4

CVE-2026-2257 MEDIUM

GetGenie WordPress Plugin <=4.3.2 - Stored XSS

CVSS 6.4

CVE-2026-1704 MEDIUM

Appointment Booking Calendar <1.6.9.29 - Insecure Direct Object Reference

CVSS 4.3

CVE-2026-2366 LOW

Keycloak - Auth Bypass

CVSS 3.1

CVE-2026-32131 HIGH

ZITADEL <3.4.8/4.12.2 - Info Disclosure

CVSS 7.7

CVE-2026-27591 CRITICAL

Winter CMS <1.0.477/1.1.12/1.2.12 - Privilege Escalation

CVSS 9.9

CVE-2026-32104 MEDIUM

StudioCMS <0.4.3 - Privilege Escalation

CVSS 5.4

CVE-2026-32103 MEDIUM

StudioCMS <0.4.3 - Privilege Escalation

CVSS 6.8

CVE-2026-32097 HIGH

PingPong <7.27.2 - Path Traversal

CVSS 8.8

CVE-2026-31874 CRITICAL

Taskosaur 1.0.0 - Privilege Escalation

CVSS 9.8

CVE-2026-31867 MEDIUM

Craft Commerce <4.11.0/5.6.0 - IDOR

CVSS 4.8

CVE-2026-1992 HIGH

ExactMetrics 8.6.0-9.0.2 - Auth Bypass

CVSS 8.8

CVE-2026-2918 MEDIUM

Happy Addons for Elementor <3.21.0 - Privilege Escalation

CVSS 6.4

CVE-2026-2917 MEDIUM

Happy Addons for Elementor <3.21.0 - IDOR

CVSS 5.4

CVE-2026-1753 MEDIUM

Gutena Forms <1.6.1 - Privilege Escalation

CVSS 6.8

CVE-2026-3453 HIGH

ProfilePress <=4.16.11 - Insecure Direct Object Reference

CVSS 8.1

CVE-2026-31832 MEDIUM

Umbraco 14.0.0-16.5.0/17.0.0-17.2.1 - Privilege Escalation

CVSS 5.4

CVE-2026-31820 MEDIUM

Sylius - IDOR

CVSS 6.5

CVE-2026-30954 MEDIUM

LinkAce <=2.1.0 - Privilege Escalation

CVSS 4.3

CVE-2026-3306 MEDIUM

GitHub Enterprise Server - Privilege Escalation

CVSS 4.3

CVE-2026-30969 CRITICAL

Coral Server <1.1.0 - Auth Bypass

CVSS 9.1