CVE-2026-15095 Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-15095

The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress is vulnerable to directory traversal in all versions up to and including 6.6.43 via the provider parameter. Authenticated attackers with Shop Manager or higher privileges can delete arbitrary files on the server by issuing t...

CVE-2026-18345

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-18345 WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

EUVD-2026-84307

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-18345

The WP User Manager plugin for WordPress (versions up to and including 2.9.18 ) is vulnerable to unauthorized data modification due to a missing capability check in the Connect::complete() function. This function is registered on the admin_init hook and fails to perform current_user_can() or nonc...

CVE-2026-18345 WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

ROOT-APP-NPM-CVE-2022-23529 CVE-2022-23529 in jsonwebtoken - Patched by Root

Root has patched CVE-2022-23529 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...

Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition

Summary Multiple vulnerabilities were addressed in IBM Tivoli Network Manager IP Edition 4.2.0.25 Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a...

[SECURITY] Fedora 45 Update: patool-4.1.0-1.fc45

Patool is an archive file manager. Various archive formats can be created, extracted, tested, listed, searched, repacked and compared with patool. The advantage of patool is its simplicity in handling archive files without having to remember a myriad of programs and options. The archive format is...

PT-2026-97099

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Remote attackers can execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor. Thi...

CVE-2026-17643: Insufficiently Protected Credentials

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials...

CVE-2026-18172: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-95500: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-18170: Allocation of Resources Without Limits or Throttling

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling...

CVE-2026-18124: Insufficiently Protected Credentials

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected credentials...

CVE-2026-18153: Use of a Broken or Risky Cryptographic Algorithm

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors...

CVE-2026-18095: Out-of-bounds Write

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

CVE-2026-17646: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-18066: Server-Side Request Forgery (SSRF)

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...