PT-2026-107835

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile da...

PT-2026-107830

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

PT-2026-108226

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description A protection mechanism failure allows a remote authenticated attacker to execute arbitrary code. Recommendations Upda...

CVE-2026-107706: Incorrect Authorization

Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to...

CVE-2026-84274: Exposure of Sensitive Information to an Unauthorized Actor

IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and APIKEY rotation processing, sensitive credential material is logged at INFO level by the edge-controller/edge-manager components. An authenticated attacker with access to the...

CVE-2026-10631: Authorization Bypass Through User-Controlled Key

An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant...

CVE-2026-15781: Stack-based Buffer Overflow

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

PT-2026-108135

Name of the Vulnerable Software and Affected Versions MongoDB libmongocrypt affected versions not specified Description An integer underflow exists in the KMS endpoint-parsing logic. This occurs when an authenticated user modifies a key document in the key vault collection, or when an application...

CVE-2026-19482: Improper Neutralization of Argument Delimiters in a Command

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments...

PT-2026-108192

Name of the Vulnerable Software and Affected Versions Indico versions prior to 3.3.13 Description An authenticated user can misuse the legacy session export API to retrieve details for a restricted session without having the required access, provided the containing event is accessible. This missi...

PT-2026-107805

An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search...

PT-2026-107935

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description A...

PT-2026-107826

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

PT-2026-107879

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An authenticated high privilege user can perform argument injection in troubleshooting commands, which can lead to privilege escalation. Argument injection occu...

PT-2026-108229

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of command arguments. Th...

PT-2026-108029

Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names...

PT-2026-108228

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description Remote authenticated attackers can perform unauthorized actions due to argument injection, a flaw where untrusted inp...

PT-2026-108234

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description A remote authenticated attacker can bypass additional authentication workflow steps. Recommendations At the moment,...

Langflow AI Code Validation Authenticated Remote Code Execution

Langflow versions 1.0.0 through 1.10.0 are susceptible to authenticated remote code execution due to improper validation of code in the /api/v1/validate/code endpoint. Arbitrary code is executed under the context of the backend Langflow process. This module requires Metasploit:...

CVE-2026-94578: Improper Privilege Management

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA Authentication, Authorization, and Accounting integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific...