CVE-2026-84098

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...

CVE-2026-86603

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

CVE-2026-91073 Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

CVE-2026-86603 WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

CVE-2026-12803

A flaw was found in Bouncy Castle for Java. The cryptographic module responsible for authenticated encryption does not correctly link a unique random value nonce with the message authentication code when no additional authenticated data is provided. This oversight could allow an attacker to forge...

CVE-2026-96271

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

EUVD-2026-84985

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...

EUVD-2026-84953

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

EUVD-2026-84952

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

EUVD-2026-84950

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

EUVD-2026-84945

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors...

EUVD-2026-84938

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

EUVD-2026-84957

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

EUVD-2026-84943

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization...

EUVD-2026-84942

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...

EUVD-2026-84962

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management...

EUVD-2026-84974

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84966

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity...

EUVD-2026-84972

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84977

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...