CVE-2026-97079

MediumCVSS 4.3/10Last modified Sep 30, 2026

Description

Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-97084.9Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has acceCVE-2026-97097.7The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated uCVE-2026-97107.7The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes theCVE-2026-97119.8The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' CVE-2026-97123.8When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35CVE-2026-97137.5The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uCVE-2026-97146.4The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [showmodule] shortCVE-2026-971464.8Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod hasCVE-2026-971477.2In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another projecCVE-2026-971495.3In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only coCVE-2026-971508.6When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP cCVE-2026-971518.4mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a craf
CVE-2026-97079: Medium severity, CVSS 4.3 | Vulnix