https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T04:30:03.429960+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-92421 CVE-2026-92421 — Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR 2026-10-07T04:30:03.446240+00:00

Affected: Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.