tag
Idor
High
Langflow Responses API IDOR — Execute Another User's Flow (CVE-2026-55255)
CVE-2026-55255 (GHSA-qrpv-q767-xqq2)·
Langflow — open-source platform for building and deploying AI-powered agents and workflows (langflow-ai/langflow), OpenAI-compatible Responses API
patched
Medium
WordPress Download Manager 3.3.5.2 — Unauthenticated IDOR (CVE-2026-39676)
CVE-2026-39676·
Download Manager plugin for WordPress
unpatched
Medium
Vaultwarden Organization Collection Permissions Bypass & Cipher Enumeration (CVE-2026-26012)
CVE-2026-26012 (GHSA-h265-g7rm-h337)·
Vaultwarden (unofficial Bitwarden-compatible server)
unpatched
High
Saleor GraphQL IDOR — Unauthenticated Order PII Exfiltration (CVE-2026-24136)
CVE-2026-24136·
Saleor e-commerce platform (GraphQL API)
patched
High
Eventin (wp-event-solution) Broken Access Control / IDOR (CVE-2026-40776)
CVE-2026-40776 / Patchstack PSID 85de025d71e7·
Eventin — Events Calendar, Event Booking, Ticket & Registration (wp-event-solution WordPress plugin)
patched
High
AutoGPT Platform Chat Session IDOR / Session Hijack — CVE-2026-30950
CVE-2026-30950 (GHSA-q58p-v9r9-7gqj)·
AutoGPT Platform (autogpt-platform-backend, chat/copilot feature)
unpatched