CVE-2026-9858 Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxpordershipment, wxporderitemshipment, and wxpordersetshipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php register...

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

CVE-2026-84078

IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privileged load-balancer operations, potentially resulting in unauthorized actions and impact to the integrity and availability of the affected...

CVE-2026-59283

A flaw was found in Spring Framework. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. This could allow an attacker to circumvent security restrictions,...

EUVD-2025-210953

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2025-15399 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2025-15399

CVE-2025-15399 is a cross-site request forgery (CSRF) vulnerability (CWE-352) affecting IBM Common Licensing (also known as IBM License Key Server Administration and Reporting Tool / LKS Administration Agent) versions 9.0, 9.0.0.1, and 9.0.0.2 . An attacker could execute malicious and unauthorize...

CVE-2025-15399 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2026-89008

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...

CVE-2026-87771

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

EUVD-2026-82659

The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site...

CVE-2026-81810

The All-in-One WP Migration and Backup WordPress plugin (versions before 7.111 ) is vulnerable to authenticated privilege escalation to administrator access. The flaw exists because several AJAX actions lack proper capability checks, relying instead on an installation-wide secret. This secret is ...

CVE-2026-87771: Improper Neutralization of Special Elements used in an SQL Command

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

Atlassian Jira Service Management Data Center and Server 10.3.x < 10.3.24 / 11.3.x < 11.3.10 (JSDSERVER-16729)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16729 advisory. - This High severity BASM Broken Authentication & Session Management vulnerability known as...

PT-2026-95401

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description An issue exists where strict validation of the chunk-size line is skipped when the line contains no chunk extension ;. A remote attacker can exploit this by sending a specially crafted HTTP...

PT-2026-95232

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup WordPress plugin versions prior to 7.111 Description Several AJAX actions do not perform proper capability checks and are instead protected by an installation-wide secret. This secret is disclosed to any user...

CVE-2026-84904: Missing Authorization

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...

CVE-2025-15399: Cross-Site Request Forgery (CSRF)

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

PT-2026-95494

Name of the Vulnerable Software and Affected Versions WACRM versions prior to 0.7.1 Description Account viewers can perform unauthorized actions because flow and automation write routes fail to enforce the agent role before utilizing a service-role database client that bypasses row-level security...

CVE-2026-84078: Missing Authentication for Critical Function

IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privileged load-balancer operations, potentially resulting in unauthorized actions and impact to the integrity and availability of the affected...