Security Bulletin: IBM WebSphere Application Server is affected by a privilege escalation (CVE-2026-11545)

Summary IBM WebSphere Application Server is affected by a privilege escalation vulnerability. Vulnerability Details CVEID:CVE-2026-11545 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to obtain sensitive information from the administrative console due to missing...

WordPress Checkout Custom Fields Builder for WooCommerce plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by Nabil Irawan in WordPress Plugin Checkout Custom Fields Builder for WooCommerce versions = 1.1.5...

CVE-2026-83941

Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network...

CVE-2026-83942

Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-73014

Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally...

CVE-2026-72966

Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally...

CVE-2026-69724

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-69641

Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-69553

Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network...

CVE-2026-69465

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-69453

Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally...

CVE-2026-69403

Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally...

CVE-2026-69380

Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-69377

Missing authorization in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo

CVE: This vulnerability corresponds to CVE-2026-72790. Relationship to GHSA-8x84-r2ff-h8pq please read first getNotebookInfo is named in the earlier advisory GHSA-8x84-r2ff-h8pq, in its remediation section, which asked for reader filtering on both getNotebookConf and getNotebookInfo. Commit...

GHSA-74PJ-6G7R-J55C SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo

CVE: This vulnerability corresponds to CVE-2026-72790. Relationship to GHSA-8x84-r2ff-h8pq please read first getNotebookInfo is named in the earlier advisory GHSA-8x84-r2ff-h8pq, in its remediation section, which asked for reader filtering on both getNotebookConf and getNotebookInfo. Commit...

CVE-2026-81823 AVEVA Pipeline Integrity Monitor Missing Authorization

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted...

CVE-2026-81823 AVEVA Pipeline Integrity Monitor Missing Authorization

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted...

CVE-2026-81823

CVE-2026-81823 affects AVEVA Pipeline Integrity Monitor , specifically its PIMBoards component. A missing authorization flaw allows an unauthenticated attacker to perform read operations intended only for PIMBoards users, resulting in information disclosure . Write operations are not impacted. Th...

WordPress ilGhera Reviso Exporter for WooCommerce plugin <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function vulnerability

Missing Authorization to Authenticated Subscriber+ Agreement Grant Token Deletion via disconnectcallback Function vulnerability discovered by Legion Hunter in WordPress Plugin ilGhera Reviso Exporter for WooCommerce versions = 1.2.3...