Security update for python-WebOb

This update for python-WebOb fixes the following issues: CVE-2026-54770: an unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft bsc1275917. Patch Instructions: To install this SUSE upda...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in nanoid (CVE-2026-73086)

Summary A predictable unique ID generation vulnerability in the nanoid generator library CVE-2026-73086 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.3.17. Vulnerability Details CVEID:CVE-2026-73086 DESCRIPTION: nanoid is a secure,...

CVE-2026-87979

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-83555

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

CVE-2026-89331

The FluentBoards WordPress plugin (versions 1.95-2.0.15 ) is vulnerable to an unauthenticated board member email address disclosure vulnerability. The flaw exists because the plugin fails to properly restrict member data returned by its public, token-shared board feature . This allows unauthentic...

CVE-2026-87979 Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-87979

The Paymob for WooCommerce WordPress plugin, in versions before 4.1.14 , is vulnerable to a security flaw where it fails to verify the request signature on the card-token branch of its payment webhook. This lack of authorization allows unauthenticated attackers to write a card-token record to any...

EUVD-2026-85049

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

WordPress Paymob for WooCommerce plugin < 4.1.14 - Unauthenticated Saved Card Token Write to Any User vulnerability

Unauthenticated Saved Card Token Write to Any User vulnerability discovered by Salúa Es-sair in WordPress Plugin Paymob for WooCommerce versions 4.1.14...

EUVD-2026-85053

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

CVE-2026-87979 Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

EUVD-2026-85048

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

CVE-2026-83555 Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

EUVD-2026-85031

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

CVE-2026-83555

The Email Subscribers & Newsletters WordPress plugin (versions before 5.9.35 ) is vulnerable to an unauthenticated subscription status change . The root cause is a failure to verify the per-subscriber management token when updating subscription statuses. This allows unauthenticated users to force...

CVE-2026-82843 WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

CVE-2026-82843 WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

CVE-2026-83555 Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

CVE-2026-82843

The WP OAuth Server (Login with WordPress) WordPress plugin, in versions before 6.4.0 , is vulnerable to a cross-user account takeover due to an improper authentication flaw. The plugin fails to bind the issued OpenID Connect identity assertion to the specific authorization grant being exchanged....

CVE-2022-4997

The jet-form-builder-stripe-gateway WordPress plugin versions prior to 1.1.0 is vulnerable to an unauthenticated Blind SQL Injection . The root cause is the failure to sanitize and escape a payment token before utilizing it in a SQL statement. This flaw allows unauthenticated attackers to extract...