CVE-2026-87829

Checkout Field Manager (Checkout Manager) for WooCommerce (WordPress plugin) versions before 7.9.7 contain an improper authorization flaw in attachment deletion. The plugin fails to properly validate the ownership of an attachment before allowing its deletion, enabling any authenticated user with...

EUVD-2026-81395

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87829 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-91019

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

CVE-2026-91008

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

EUVD-2026-81358

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

CVE-2026-91019

The Event Booking Manager for WooCommerce WordPress plugin (also referred to as WpEvently ) versions prior to 5.6.0 is vulnerable to an improper access control flaw. The plugin fails to restrict access to its stored payment gateway configurations, allowing users with Contributor-level access or h...

CVE-2026-91008 Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

CVE-2026-91008

The Event Booking Manager for WooCommerce WordPress plugin, in versions prior to 5.3.8 , is vulnerable to an unauthenticated attendee PII disclosure . The flaw exists because the plugin fails to perform adequate ownership or authorization checks before rendering booking confirmation details. An a...

EUVD-2026-81351

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

CVE-2026-91008 Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

bramble v1.29.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

PT-2026-95016

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager fails to enforce HTTPS for repository and package mirror URLs within the mport fetch index, mport fetch bootstrap index, and mport fetch bundle functions located in...

CVE-2026-54471: Improper Handling of Insufficient Permissions or Privileges

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

PT-2026-95017

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description In the MidnightBSD Package Manager, directory assets handled as ASSET DIR or ASSET DIR OWNER MODE in the libmport/bundle read install pkg.c file utilize path-based mport mkdirp, ownership, and permissi...

PT-2026-94303

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

CVE-2026-54575: Improper Neutralization of Special Elements used in an OS Command

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

CVE-2026-54583: Improper Limitation of a Pathname to a Restricted Directory

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...