EUVD-2026-94654

A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters...

CVE-2026-87679

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploi...

CLEANSTART-2026-GJ18736 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

CVE-2026-79993 affects multiple packages. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. See references for...

PT-2026-107847

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

PT-2026-107846

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

PT-2026-107842

A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine VM. This can happen when the SANnav server encounters an Out Of Memory OOM condition. The...

PT-2026-107825

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters...

PT-2026-107830

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

PT-2026-108234

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description A remote authenticated attacker can bypass additional authentication workflow steps. Recommendations At the moment,...

PT-2026-108232

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description Improper authentication may allow a remote authenticated attacker to bypass security restrictions. Recommendations At...

PT-2026-107836

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on th...

PT-2026-108016

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description A...

PT-2026-107724

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploi...

PT-2026-107879

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An authenticated high privilege user can perform argument injection in troubleshooting commands, which can lead to privilege escalation. Argument injection occu...

PT-2026-108211

Name of the Vulnerable Software and Affected Versions Satel Netco Design versions prior to 2.1.7 Description An inefficient regular expression complexity issue exists where an authenticated user with Viewer privileges can submit crafted search input. This leads to excessive processing, which may...

PT-2026-108225

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description An SQL injection flaw allows a remote authenticated attacker to modify data and cause a denial of service. SQL...

PT-2026-108226

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description A protection mechanism failure allows a remote authenticated attacker to execute arbitrary code. Recommendations Upda...

PT-2026-107835

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile da...

CVE-2026-107801: Improper Neutralization of Input During Web Page Generation

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share i...

PT-2026-108104

Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description The upload-processing pipeline in scripts/safe-extract.py fails to apply entry-count, nesting-depth, and total-uncompressed-byte limits when processing single-stream compressed formats such a...