CVE-2026-62279 LubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership Check

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds the user could edit. The endpoint...

WordPress Checkout Field Manager (Checkout Manager) for WooCommerce plugin 7.4.9-7.9.6 - Subscriber+ Arbitrary Attachment Deletion vulnerability

Subscriber+ Arbitrary Attachment Deletion vulnerability discovered by PO-WEI TING Dinlon5566, Open Information Security Inc. in WordPress Plugin WooCommerce Checkout Manager versions 7.4.9-7.9.6...

CVE-2026-85127 VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

CVE-2026-85127

The VikBooking Hotel Booking Engine & PMS WordPress plugin, specifically versions 1.8.8 through 1.8.14 , is vulnerable to an unauthenticated stored XSS vulnerability. The flaw exists because the plugin fails to restrict file types or sanitize the contents of files attached by unauthenticated visi...

WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen

Description WordPress does not check that the user is allowed to read an attachment's parent post before displaying its title on an admin screen in some cases, which could allow users with a role as low as author to learn the title of a private or draft post they cannot access...

CVE-2026-87829

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87831 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87831 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87829 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87829

Checkout Field Manager (Checkout Manager) for WooCommerce (WordPress plugin) versions before 7.9.7 contain an improper authorization flaw in attachment deletion. The plugin fails to properly validate the ownership of an attachment before allowing its deletion, enabling any authenticated user with...

EUVD-2026-81395

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87829 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

PT-2026-94176

Name of the Vulnerable Software and Affected Versions Active Woot Products Tables for WooCommerce versions prior to 2.1.3 Description Certain AJAX actions in the plugin lack authorization and Cross-Site Request Forgery CSRF checks. This allows any authenticated user, including those with subscrib...

The vulnerability of the download mechanism of the SmarterTools SmarterMail email server allows a perpetrator to execute arbitrary code.

The vulnerability of the attachment loading mechanism in the SmarterTools SmarterMail email server relates to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2026-93807

Name of the Vulnerable Software and Affected Versions WuzhiCMS versions prior to 4.1.1 Description A server-side request forgery SSRF exists in the Remote Image Fetch component. This occurs when the ckditor::saveRemote function in the coreframe/app/attachment/index.php file improperly handles the...

CVE-2026-89141 AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-89141 AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

PT-2026-92375

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-postin...

EUVD-2026-77795

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluenceuploadattachment and confluenceuploadattachments tools pass a client-controlled filepath through src/mcpatlassian/confluence/attachments.py uploadattachment, and the...

CVE-2026-73496 MCP Atlassian: Arbitrary server-side file read via attachment upload

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluenceuploadattachment and confluenceuploadattachments tools pass a client-controlled filepath through src/mcpatlassian/confluence/attachments.py uploadattachment, and the...