EUVD-2026-85808

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event...

PT-2026-97720

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.5 Description An issue exists in the Events Manager WordPress plugin where the scope of logged-in event and location searches is not enforced when a user provides a custom owner value. This allows a...

CVE-2026-93662: Exposure of Sensitive Information to an Unauthorized Actor

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...

CVE-2026-93661: Authorization Bypass Through User-Controlled Key

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event...

PT-2026-97726

Name of the Vulnerable Software and Affected Versions Kubernetes affected versions not specified Description A confused deputy attack in the kube-controller-manager allows a user with write permissions for StatefulSet and ControllerRevision objects within their own namespace to potentially create...

PT-2026-97719

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.5 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to prevent a ticket-update request from replacing the identifiers of the ticket it was authorized against. This allows a...

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution...

RHEL 10 : yggdrasil-worker-package-manager (RHSA-2026:71420)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71420 advisory. yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.6.0 Vulnerability Details CVEID:CVE-2026-59278 DESCRIPTION: JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include...

WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Admin Notices Manager versions = 1.6.0...

CVE-2026-95603

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95530

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...

CVE-2026-95522

Shop manager SQL Injection in Easy Digital Downloads = 3.7.0 versions...

CVE-2026-94079

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

CVE-2026-95603

The Reycob Product Import Export plugin for WordPress, specifically versions

CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95530

The PixelYourSite – Your smart PIXEL (TAG) Manager WordPress plugin is vulnerable to a Subscriber Cross Site Scripting (XSS) flaw in versions

EUVD-2026-85498

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...

CVE-2026-95530 WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...