2026

  • cross-family access in churchcrm

    cve-2026-58410 let low-privileged churchcrm users with editself access read and modify other families records by changing the familyId in API routes

    b b4r
    July 3, 2026
    4 min read
    vulnerability cve web exploitation idor

  • breaking shopper checkout from settings

    cve-2026-56826 let low-privileged shopper users with settings access delete tax, zone, shipping, and carrier configuration through missing authorization on Livewire actions

    b b4r
    July 2, 2026
    5 min read
    vulnerability cve web exploitation authorization

  • a tooltip xss in wikimedia charts

    cve-2026-14358 was a stored xss in the mediawiki charts extension where Data:*.tab field titles could reach the pie chart tooltip html renderer

    b b4r
    July 2, 2026
    3 min read
    vulnerability cve web exploitation xss