Security Bulletin: Due to the use of Java SE, IBM Sterling Control Center is vulnerable to multiple CVEs (CVE-2026-70906, CVE-2026-61308, CVE-2026-70907, CVE-2026-60589, CVE-2026-16440)

Summary Java SE is used by IBM Sterling Control Center as part of dependency in IBM Semeru Runtime CSPU - Aug 2026 - Includes OpenJDK August 2026 CPU. Vulnerability Details CVEID:CVE-2026-70906 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via...

CVE-2026-97309

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...

CVE-2026-97275

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-55280

In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-103334

Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24...

CVE-2026-103349

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7...

EUVD-2026-92758

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71299

A flaw was discovered in Maestro where its REST API write endpoints were registered without proper authentication middleware . This vulnerability allows a remote attacker to perform unauthorized write operations, specifically creating, modifying, or deleting consumers and resource bundles . Such ...

CVE-2026-71299 Maestro: maestro: rest api write endpoints registered without authentication middleware

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71298 Maestro: sql identifier injection via properties.* search filter and orderby field

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-71299

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

EUVD-2026-92757

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-71298

A SQL injection vulnerability exists in maestro within the orderBy query parameter of its REST API list endpoints. This flaw allows a remote attacker to perform read-only blind extraction of data from the database without authentication. To mitigate this risk, users should restrict network access...

CVE-2026-71298 Maestro: sql identifier injection via properties.* search filter and orderby field

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-71298

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database. Mitigation To mitigate this...

CVE-2026-97257 WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7...

CVE-2026-97257

The PressTigers Simple Event Planner WordPress plugin is vulnerable to a PHP Object Injection flaw due to the deserialization of untrusted data . This vulnerability affects versions up to and including 1.5.7 . An attacker can leverage this flaw to perform Object Injection , potentially leading to...

EUVD-2026-92750

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7...

CVE-2026-100511

The VK Google Job Posting Manager WordPress plugin (versions

CVE-2026-100511 WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1...