CVE-2026-16940: Improper Limitation of a Pathname to a Restricted Directory

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php, which can lead to a full site takeover...

CVE-2026-16605: Missing Authorization

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor Store Owner and above to view, take over, permanently delete, or modify any other vendor's store on the marketplace...

CVE-2026-5581: Missing Authorization

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...

CVE-2026-17556: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...

CVE-2026-48912: Authorization Bypass Through User-Controlled Key

Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to...

PT-2026-68554

Name of the Vulnerable Software and Affected Versions WPBruiser no- Captcha anti-Spam versions prior to 3.1.44 Description The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to manipulate the resulting object. Thi...

PT-2026-68152

Name of the Vulnerable Software and Affected Versions Zigbee2MQTT affected versions not specified Description An issue exists in the ExternalJSExtension.getFilePath function within lib/extension/externalJS.ts where a name parameter received via the MQTT topic...

PT-2026-68188

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.2 Description Improper input validation in the avatar-cleanup logic allows an authenticated user to delete files uploaded by other users. This occurs because the system fails to perform an ownership check wh...

PT-2026-68168

Name of the Vulnerable Software and Affected Versions Content Egg – Affiliate Product Importer & Price Comparison versions prior to 11.3.1 Description An arbitrary file deletion issue exists due to path traversal, where an attacker can use special character sequences to access and delete files...

CVE-2026-15979: Improper Limitation of a Pathname to a Restricted Directory

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...

CVE-2026-6627: Missing Authorization

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...

CVE-2026-7658: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

PT-2026-68290

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Improper validation of the username field allows attackers to inject path traversal sequences—a technique used to access files and directories outside the intended folder—and bypass...

PT-2026-68023

Name of the Vulnerable Software and Affected Versions Crater affected versions not specified Description An authorization bypass exists where the software fails to enforce company-ownership checks within the CustomerPolicy for view, update, and delete operations. While other policies verify both ...

CVE-2026-16613: Cross-Site Request Forgery (CSRF)

The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the DELETE /api/v1/folders/id process. An attacker can permanently delete another user's chat history and subfolders by exploiting inherited write permissions on shared...

GHSA-3CG5-48J3-V4GV Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of...

CVE-2026-70494

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/id handler in backend/openwebui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages...

CVE-2026-70494 Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/id handler in backend/openwebui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages...

CVE-2026-70494 Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/id handler in backend/openwebui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages...