CVE-2026-94246

The Wallet System for WooCommerce WordPress plugin, versions before 2.8.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify that the wallet account specified in a withdrawal submission belongs to the authenticated user. This allows any authenticat...

CVE-2026-94246 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount a...

EUVD-2026-94750

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

CVE-2026-94244 Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

EUVD-2026-94751

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

CVE-2026-94245

The Wallet System for WooCommerce WordPress plugin (versions before 2.8.0 ) contains an authorization bypass vulnerability. The plugin fails to verify if the user submitting a wallet transfer actually owns the wallet being debited. This allows any authenticated user, including those with only the...

CVE-2026-94244

The Wallet System for WooCommerce WordPress plugin, in versions before 2.8.0 , is vulnerable to a store-wide wallet transaction disclosure. The root cause is a lack of capability checks where the plugin relies on a token obtainable by any authenticated user from a front-end page to generate repor...

WordPress Wallet System for WooCommerce plugin < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure vulnerability

Subscriber+ Store-Wide Wallet Transaction Disclosure vulnerability discovered by Sanyam Jain, Astra Security in WordPress Plugin Wallet System for WooCommerce versions 2.8.0...

CVE-2026-94245 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

CVE-2026-87662

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control...

CVE-2026-87688

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution i...

CVE-2026-87674

A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication IPC channels allow an unprivileged local user to submit malformed logging...

CVE-2026-87674

A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication IPC channels allow an unprivileged local user to submit malformed logging...

CVE-2026-87674

A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication IPC channels allow an unprivileged local user to submit malformed logging...

CVE-2026-87674

A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 . The root cause is insufficient access controls on internal inter-process communication (IPC) channels, which allows an unprivileged local user t...

EUVD-2026-94689

A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication IPC channels allow an unprivileged local user to submit malformed logging...

EUVD-2026-94686

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

CVE-2026-87688

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. The flaw occurs because user-supplied certificate identifiers are processed without adequate sanitization before being executed in external system rout...

CVE-2026-87688

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution i...

CVE-2026-87659

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrative...