Medium
CVE-2026-10736
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 124
Reset filters
Medium
CVE-2026-6965
Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
Medium
CVE-2026-40743
Tutor LMS – eLearning and online course solution <= 3.9.7 - Missing Authorization
Medium
CVE-2026-6080
Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter
Medium
CVE-2026-5502
Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order
Medium
CVE-2026-3371
Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification
Medium
CVE-2026-3358
Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
High
CVE-2026-3360
Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter
Medium
CVE-2026-25406
Tutor LMS Pro <= 3.9.8 - Missing Authorization
Medium
CVE-2025-32223
Tutor LMS – eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-40740
Tutor LMS <= 3.9.7 - Missing Authorization
Critical
CVE-2026-0953
Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login
High
CVE-2025-13673
Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
Medium
CVE-2026-23799
Tutor LMS – eLearning and online course solution <= 3.9.5 - Missing Authorization
Medium
CVE-2026-1258
Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints
Medium
CVE-2026-1787
LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion
Medium
CVE-2026-1371
Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
High
CVE-2026-1375
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
Medium
CVE-2026-0548
Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
Medium
CVE-2026-24584
Tutor LMS BunnyNet Integration <= 1.0.0 - Authenticated (Tutor instructor+) Stored Cross-Site Scripting
High
CVE-2026-22332
Tutor LMS Pro <= 3.9.6 - Unauthenticated SQL Injection
Medium
CVE-2025-13628
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification
Medium
CVE-2025-13935
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion
Medium
CVE-2025-13934
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.