Security Bulletin: IBM i is Affected By Denial of Service in Host Servers [CVE-2026-17015]

Summary IBM i is vulnerable to a denial of service due to an out-of-bounds read CVE-2026-17015 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17015 DESCRIPTION: IBM i could allow a remote authenticated attacker to cause a denial of service and obtain...

EUVD-2026-60441

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-16047

Mattermost versions 11.7.x ≤ 11.7.6, 10.11.x ≤ 10.11.21, and 11.8.x ≤ 11.8.3 contain an authorization flaw in the board-to-channel linking functionality. The server fails to verify that the requesting user has read access to a target channel before associating a board with it. An authenticated us...

CVE-2026-16139 Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution

In Progress ShareFile Storage Zones Controller versions = 5.12.5 and = 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote...

CVE-2026-74845

CVE-2026-74845 concerns the Official Document Management System by 2100 Technology, with an Arbitrary File Upload vulnerability that enables authenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server. From the connected references, ...

CVE-2026-15623

A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...

PT-2026-76671

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied post id , and fails to validate the web url parameter against the configured GitLab instance, which allows an authenticated...

CVE-2026-2497

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-17604

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-17604

The CVE (CVE-2026-17604) affects the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. All versions up to 6.1.1 are vulnerable to Directory Traversal via the data parameter. Authentication with at least editor-level access is required, enabling an attacker to read arbi...

EUVD-2026-59928

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

EUVD-2026-59925

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-2497 Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-2497

The CVE concerns The Gallery by BestWebSoft plugin for WordPress, affecting all versions up to 4.7.9. The vulnerability is an SQL Injection via the gallery_order {post_id} parameter array keys, arising from unsanitized array keys stored from $_POST into post meta and later injected into SQL queri...

CVE-2026-17581

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

CVE-2026-15056

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...

CVE-2026-15790

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emdmbmeta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field:...

CVE-2026-15351

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-9767

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-59905

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...