EUVD-2026-81396

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87831

CVE-2026-87831 affects the Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin in versions before 7.9.7 . The plugin does not properly validate attachment ownership before deletion, allowing any authenticated user (e.g., a customer) to delete arbitrary media attachments bel...

CVE-2026-87831 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87831 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87829 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87829 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

EUVD-2026-81395

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87829

Checkout Field Manager (Checkout Manager) for WooCommerce (WordPress plugin) versions before 7.9.7 contain an improper authorization flaw in attachment deletion. The plugin fails to properly validate the ownership of an attachment before allowing its deletion, enabling any authenticated user with...

CVE-2026-92757: Missing Encryption of Sensitive Data

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-87829: Authorization Bypass Through User-Controlled Key

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-92515: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested structs btffindstructfield initializes a fresh seen mask for every recursive descent. Unique special fields in different levels of the same aggregate therefore do not see one another...

Fedora 43 : php-pecl-mongodb2 (2026-caf49a7828)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-caf49a7828 advisory. Version 2.1.9 - PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in 2081 CVE-2026-84968 Tenable has extracted the...

CVE-2026-87831: Missing Authorization

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

GHSA-33F5-2C5Q-WGWJ RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

Summary The rmcp library does not validate the resource parameter in OAuth Protected Resource metadata RFC 9728, allowing a malicious MCP server to redirect OAuth flows to a legitimate authorization server and steal the resulting access tokens. Details RFC 9728 specifies two MUST requirements for...

CVE-2026-92771

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

CVE-2026-92784 @refinedev/inferencer through 7.0.0 Code Injection via API Field Names

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

EUVD-2026-81047

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

CVE-2026-92784

@refinedev/inferencer through version 7.0.0 (part of the refine framework) is vulnerable to code injection via API field names . The root cause is a failure to escape API field names when interpolating them into generated JSX source code . An attacker controlling the data provider can inject mali...

CVE-2026-92784 @refinedev/inferencer through 7.0.0 Code Injection via API Field Names

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

CVE-2026-92784 @refinedev/inferencer through 7.0.0 Code Injection via API Field Names

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...