The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability involving inefficient regular expression complexity that can lead to a Regular Expression Denial of Service (ReDoS) attack. Additionally, these versions suffer from improper neutralization of wildcard query operators. This vulnerability has a critical severity rating with a CVSS score of 9.6.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a vulnerability where a hard-coded cryptographic key is used to protect stored credentials. An attacker with access to the stored data could decrypt sensitive credentials by exploiting this hard-coded key. This vulnerability does not require user interaction or privileges but has a high impact on confidentiality.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 use a cryptographically weak pseudo-random number generator (PRNG), which could allow a local attacker to obtain sensitive information. This vulnerability is identified as CWE-338 and has a medium severity rating with a CVSS score of 5.1.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a vulnerability due to the use of a cryptographically weak pseudo-random number generator (PRNG). This weakness could allow a remote attacker to gain full administrative control of the affected system. The vulnerability is identified as CWE-338 and has a high severity rating with a CVSS score of 8.1.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a server-side request forgery (SSRF) vulnerability that allows a remote authenticated attacker to obtain sensitive information. The vulnerability is identified as CWE-918 and has a high severity score of 8.5. It requires low attack complexity and no user interaction but does require privileges to authenticate. The flaw impacts confidentiality significantly but has limited impact on integrity and no impact on availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote attacker to bypass protections that block requests to internal addresses, enabling the server to access internal network resources and potentially disclose sensitive information.
CVE-2026-19131 is a missing authorization vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows low-privileged users to query arbitrary indices and access sensitive data without proper authorization controls.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where the backup server's identity is not properly verified during secure connection establishment for analytics backups. This improper certificate validation could allow a network-positioned attacker to intercept backup data and potentially credentials if used.
CVE-2026-19128 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. An authenticated attacker could exploit this flaw to send unauthorized requests from the system, potentially enumerating internal network resources or facilitating further attacks. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-19126 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves the use of password hashing algorithms with insufficient computational effort, which weakens cryptographic protections. This weakness could allow an attacker to decrypt highly sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.9. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.
CVE-2026-19122 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. An authenticated privileged attacker could exploit this flaw to send unauthorized requests from the system. This may allow the attacker to enumerate internal network resources or facilitate further attacks. The vulnerability has a low CVSS score of 3.8, indicating limited impact on confidentiality and integrity, with no impact on availability. No public exploits or known active exploitation have been reported. No patch information is provided in the available data.
CVE-2026-19121 is an authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw arises from insufficient verification of tenant context against the authenticated user, potentially allowing an attacker with valid credentials to access resources belonging to other tenants. This vulnerability has a high severity rating with a CVSS score of 8.3.
CVE-2026-18838 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw arises from insufficient verification of identity information supplied in requests, allowing a remote attacker to impersonate other users. This can lead to unauthorized access to sensitive information and modification of API configurations.
CVE-2026-18836 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote attacker to make the affected component send requests to unintended destinations and receive the responses, potentially exposing sensitive information. The vulnerability has a high CVSS score of 9.3, indicating significant impact on confidentiality and integrity without requiring privileges or user interaction.
CVE-2026-18689 is an incorrect authorization vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows an authenticated user to obtain limited information about other organizations by using a token issued for a limited purpose in an unauthorized way. This could reveal the names of other organizations within the system.
CVE-2026-17428 is an authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw arises because values supplied in the request URL are used in authorization decisions without sufficient verification. This could allow a remote authenticated attacker to access sensitive information belonging to other users.