Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-21998 DESCRIPTION: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8...

CVE-2026-110466

The Tronclass software, developed by WisdomGarden , contains a Sensitive Data Exposure vulnerability (CWE-497). Authenticated remote attackers can bypass anonymous grading restrictions to obtain anonymous student information . No specific patch versions, workarounds, or evidence of in-the-wild ex...

CVE-2026-110466 WisdomGarden｜Tronclass - Sensitive Data Exposure

Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information...

CVE-2026-110466 WisdomGarden｜Tronclass - Sensitive Data Exposure

Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information...

EUVD-2026-100872

Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information...

CVE-2026-96900

The Cart Abandonment Recovery for WooCommerce WordPress plugin, in versions before 2.1.4 , is vulnerable to an IDOR flaw because it fails to verify email address ownership when selecting an abandoned-cart record. This allow unauthenticated attackers who know a customer's email to destroy or tampe...

CVE-2026-96900 Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that...

EUVD-2026-100869

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that...

CVE-2026-89288

The Fast Courier WordPress plugin (versions 5.0.0-5.2.3 ) is vulnerable to SQL injection because it fails to sanitize and escape a value used in a SQL query on an unauthenticated REST route . Specifically, the vulnerability is triggered via the 'wp_order_id' parameter. An unauthenticated attacker...

CVE-2026-89288 Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

EUVD-2026-100860

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-107594

The File Upload to Order WordPress plugin, prior to version 1.1.4 , is vulnerable to unauthenticated arbitrary file deletion . The flaw occurs because the plugin fails to validate or confine a file path derived from attacker-controlled session data before performing a deletion action. Since this ...

CVE-2026-106099

The WP Data Access WordPress plugin (versions before 5.5.84 ) is vulnerable to unauthenticated sensitive data disclosure . The plugin fails to restrict its database table export action to authorized users, instead relying on a token that is publicly printed on the pages where tables are displayed...

CVE-2026-106099 WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export

The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated...

WordPress WP Data Access plugin < 5.5.84 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Raphael P. Cigana in WordPress Plugin WP Data Access versions 5.5.84...

EUVD-2026-100883

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

EUVD-2026-100882

The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated...

EUVD-2026-100880

The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment...

CVE-2026-106098 WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access ev...

WordPress WP Data Access plugin < 5.5.77 - Unauthenticated Incorrect Authorization vulnerability

Unauthenticated Incorrect Authorization vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Data Access versions 5.5.77...