CVE-2026-18156: Missing Authorization

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization...

PT-2026-97097

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper authorization in the software allows a remote authenticated attacker to bypass security controls by forging user identities...

PT-2026-97076

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description An adjacent-network attacker could execute arbitrary code due to the deserialization of untrusted data. Deserialization is the process of...

CVE-2026-17637: Deserialization of Untrusted Data

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data...

WordPress WP User Manager – User Profile Builder & Membership plugin <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack vulnerability

Missing Authorization to Authenticated Subscriber+ Stripe Account Hijack vulnerability discovered by Wordfence PRISM in WordPress Plugin WP User Manager versions = 2.9.18...

CVE-2026-14856-TastyIgniter

CVE-2026-14856: Stored XSS to Account Takeover in TastyIgniter v4.3.0 📌 Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the file upload functionality of the Media Manager in TastyIgniter v4.3.0. Due to insufficient validation and sanitization of uploaded .svg files, an...

CVE-2026-80110

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

CVE-2026-13673

creationtimestamp| type| source ---|---|--- 2026-09-21 12:45:07+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-synology-diskstation-manager-dsm- 2026-09-21 13:20:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mvzshwm2f22i...

CVE-2026-6205

creationtimestamp| type| source ---|---|--- 2026-09-21 12:45:04+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-synology-diskstation-manager-dsm- 2026-09-21 13:20:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mvzshwm2f22i...

Security Bulletin: IBM Financial Transaction Manager v4 is impacted by multiple vulnerabilities in WebSphere Application Server Liberty

Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-57819 DESCRIPTION: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration...

Security Bulletin: IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Summary IBM Financial Transaction Manager FTM has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-18173 DESCRIPTION: IBM Financial Transaction Manager FTM could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS...

WordPress APCu Manager plugin < 4.5.0 - Unauthenticated Stored XSS via Cache Key Pollution vulnerability

Unauthenticated Stored XSS via Cache Key Pollution vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin APCu Manager versions 4.5.0...

Important: Red Hat Security Advisory: yggdrasil-worker-package-manager security update

An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

ALSA-2026:69099 Important: yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that matc...

CVE-2026-36467

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...

CVE-2026-36469: Server-Side Request Forgery (SSRF)

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery SSRF in core/modules/media.php -- uploadfrominet Media Manager's "Upload by URL" functionality...

CVE-2026-36467: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...

PT-2026-96107

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager improperly handles the TMPDIR environment variable when extracting package metafiles, even when operating as root or within setuid/setgid contexts. An attacker who can...

CVE-2026-54584: External Control of File Name or Path

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to a...

PT-2026-96126

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Server-Side Request Forgery SSRF exists in the Media Manager's "Upload by URL" functionality. The issue is located in the upload from inet function within the core/modules/media.php file. Recommendations As a...