CVE-2026-17117

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-65555

WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Uncannyowl Wordpress-extensions

Products

Uncanny Toolkit For Learndash Uncanny Toolkit For Learndash

CVE-2026-19256

All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

All In One Login

CVE-2026-100144

IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Ivpay Payments

CVE-2026-110955

Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass

The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wurdey

CVE-2026-113584

Real Estate Website Builder <= 1.4.3 - Unauthenticated Account Takeover via User Email Update

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Placester

CVE-2026-115230

WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Whizz

CVE-2026-116533

Static Snapshot <= 0.2.1 - Unauthenticated RCE via 'name' Parameter

The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Static Snapshot

CVE-2026-118423

WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Libre Form

CVE-2026-120844

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress-extensions

Products

Oauth Single Sign On – Sso (oauth Client) Oauth Single Sign On – Sso (oauth Client)

CVE-2026-107622

BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's `public_submit` flag while independently trusting the attacker-supplied `$_POST['bf_post_type']` to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (`post_id != 0`) and is completely bypassed for new-object creation — combined with the `save_post` listener `buddyforms_edit_form_save_meta_box_data()` lacking both a `current_user_can()` capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied `$_POST['buddyforms_options']` for any newly inserted `buddyforms` CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled `new_user_role` value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and achieve full site takeover. Exploitation requires the WordPress site to have "Anyone can register" enabled and at least one public BuddyForms form attached to a page, both of which are standard BuddyForms deployment configurations.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themekraft Wordpress-extensions

Products

Buddyforms Buddyforms

CVE-2026-124815

Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.

CVSS 3.1 · 10.0 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Clockinator Lite

CVE-2026-124861

Sandbox escape due to use-after-free in the Audio/Video: cubeb component

Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-124853

Sandbox escape due to incorrect boundary conditions in the Graphics: Text component

Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-64564

sctp: don't free the ASCONF's own transport in DEL-IP processing

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-121379

Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Tournamatch

CVE-2026-121491

Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.

CVSS 3.1 · 9.0 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Fiber Admin

CVE-2026-121265

SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update

SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. Its first element goes into the SQL text unescaped and the rest become bind values. A JSON array, or a repeated form field decoded as an arrayref, is such a value. An application that passes request data as column values to insert or update with the default options allows SQL injection. Releases before 2.000003 also treat an arrayref in generate() as literal SQL, including through AUTOLOAD when allow_autoload is on, whatever array_datatypes is set to.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Perl

Products

Sql::abstract

CVE-2026-76964

Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Netweaver And Abap Platform

CVE-2026-123695

Security For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token Disclosure

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Security For Woocommerce