CVE-2026-124664

Not scored yetLast modified Nov 13, 2026

Description

The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 13, 2026
Last modified
Nov 13, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1246655.3The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose ordCVE-2026-124678.3Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to CVE-2026-124688.3Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentCVE-2026-1246838.7Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokCVE-2026-1246845.1This issue can cause a heap-use-after-free when an embedder unloads a ReloadableString buffer while a previously returned raw character poinCVE-2026-1246865.4In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invCVE-2026-1246877.1In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection thCVE-2026-1246887.1In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spritCVE-2026-1246897.1In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, andCVE-2026-124694.3Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a craftCVE-2026-1246907.1In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can infCVE-2026-1246917.1In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task t
CVE-2026-124664: Unscored | Vulnix