CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

php: PHP: Archive entry injection via integer overflow in TAR parser

A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causin...

CVE-2026-93508

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-91025 Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

CVE-2026-91025 Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

CVE-2026-91025

The Booking Manager WordPress plugin, in versions prior to 2.1.21 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to verify that requests to modify per-user settings target the requesting user's own account. This flaw allows any authenticated user with subscribe...

WordPress Booking Manager plugin < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification vulnerability

Subscriber+ Arbitrary User Plugin Meta Modification vulnerability discovered by Choriyev Qahramon ciprobe in WordPress Plugin Booking Manager versions 2.1.21...

WordPress Paymob for WooCommerce plugin < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification vulnerability

Contributor+ Payment Gateway Configuration Deletion and Modification vulnerability discovered by ryan fabella in WordPress Plugin Paymob for WooCommerce versions 4.1.14...

CVE-2026-87981 Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

EUVD-2026-84963

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials...

PT-2026-97363

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Remote attackers can manipulate database queries because the software fails to properly neutralize special elements within a boolean...

CVE-2026-6718: Incorrect Default Permissions

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

CVE-2026-61834: Improperly Controlled Modification of Dynamically-Determined Object Attributes

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

PT-2026-97182

Name of the Vulnerable Software and Affected Versions Social Commerce for WooCommerce WordPress plugin versions prior to 2.5.5 Description Lack of authorization checks on certain REST API endpoints allows unauthenticated users to modify the plugin configuration and the product synchronization...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenSSH vulnerabilities (USN-8804-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8804-1 advisory. Florian Kohnhuser discovered that OpenSSH incorrectly handled shell metacharacters in certain usernames. An attacker...

TencentOS Server 4: hplip (TSSA-2026:1049)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1049 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

PT-2026-97352

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A missing authentication requirement for a critical function allows a remote attacker to access sensitive information and modify system...

PT-2026-97577

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description Improper access control allows unauthorized modification of application files. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

CVE-2026-18185: Missing Authentication for Critical Function

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...