CVE-2026-93399 Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...

CVE-2026-93399 Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...

CVE-2026-93399

The Bookly plugin for WordPress (versions up to and including 28.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The bookly_get_form_id handler blindly stores an attacker-controlled order_id into a booking session. The bookly_render_complete handler then trusts this session ...

CVE-2026-84862: Deserialization of Untrusted Data

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

CVE-2026-93399: Authorization Bypass Through User-Controlled Key

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...

PT-2026-98854

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Insecure deserialization occurs in the Quartz JDBC job store. An authenticated attacker can exploit this flaw to execute arbitrary code on the affected system. Deserialization is the proces...

VulnCheck KEV: CVE-2026-93399

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...

SUSE CVE-2026-86246

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF and ALLOWNODHEKEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, fr...

EUVD-2026-86160

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-25645 DESCRIPTION: Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filena...

Linux Distros Unpatched Vulnerability : CVE-2026-86246

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including...

CVE-2026-76087

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

EUVD-2026-85553

Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches...

CVE-2026-82368

Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches...

CVE-2026-82368

Brocade SANnav versions before 3.0.1a are susceptible to insecure access controls on internal service ports. This vulnerability allows local, non-administrative host users to communicate directly with backend management services. A local attacker can exploit this exposed access to transmit comman...

CVE-2026-82368

Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches...

EUVD-2026-85547

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

CVE-2026-93513

The SiteSkite WordPress plugin, versions

EUVD-2026-85529

Contributor Insecure Direct Object References IDOR in SiteSkite = 2.1.7 versions...

DEBIAN-CVE-2026-86246

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF and ALLOWNODHEKEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, fr...