CVE-2025-14486

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion in all versions up to and including 1.0.2 . The root cause is missing authorization checks , which allow unauthenticated attackers to delete arbitrary API keys (including Pixabay , Unsplash , Pixels , and OpenAI ) c...

CVE-2026-12995 Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the editmetavalue due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access...

CVE-2026-12995

The Custom Field Template plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in all versions up to and including 2.7.8 . The root cause is a missing validation on a user-controlled key within the edit_meta_value function. This flaw allows authenticated attackers with...

CVE-2026-12995 Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the editmetavalue due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access...

kube-monkey v0.7.0

kube-monkey kube-monkey is an implementation of Netflix's Chaos Monkey for Kubernetes clusters. It randomly deletes pods in the cluster, encouraging and validating the development of failure-resilient services. Apps opt in with a label, terminations happen during the hours and days you pick, and...

EUVD-2026-84209

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove...

PT-2026-97034

Name of the Vulnerable Software and Affected Versions openCode version 1.18.26 Description Missing path validation in the Worktree.remove component allows attackers to perform arbitrary recursive directory deletion using a crafted payload. This issue is a path traversal flaw, which occurs when an...

CVE-2025-1281: Improper Limitation of a Pathname to a Restricted Directory

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax and uxcbtoolsexportajax functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with...

VulnCheck KEV: CVE-2026-75949

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

CVE-2026-88624

The openCode software (version v1.18.26 ) is vulnerable to a security flaw due to missing path validation in the Worktree.remove component. An attacker can exploit this by providing a crafted payload to perform arbitrary recursive directory deletion . The vulnerability carries a CRITICAL severity...

PT-2026-97020

Name of the Vulnerable Software and Affected Versions Kaneo versions 2.3.12 through 2.12.1 Description Authenticated workspace members with viewer or member roles can delete and modify tasks beyond their assigned permissions. This occurs because the 'PATCH /api/task/bulk' endpoint verifies...

CVE-2025-14486: Missing Authorization

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

PT-2026-96655

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description Insufficient file path validation in the ux cb remove layout ajax and ux cb tools export ajax functions allows authenticated attackers with Subscriber-level access and above to delete...

EUVD-2026-84856

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

CVE-2026-63104: Missing Authorization

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

UBUNTU-CVE-2026-55567

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect...

CVE-2026-88624: Improper Limitation of a Pathname to a Restricted Directory

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

CVE-2026-88624

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

CVE-2026-88624

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

CVE-2026-94535

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove...