CVE-2026-16716 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions and access or modify sensitive information due to improper restriction of security token assignment.
CVE-2026-16715 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls and access sensitive information belonging to other tenants. This flaw arises from broken object-level authorization related to user-controlled keys.
A path traversal vulnerability (CWE-22) exists in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to overwrite arbitrary files on the affected system.
CVE-2026-16712 is a high-severity authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information belonging to other tenants due to insufficient permission checks on identifiers supplied in requests.
CVE-2026-16711 is an authorization vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw involves insufficient input validation that may allow a remote attacker to inject platform credentials into outbound requests. This improper authorization could lead to unintended credential exposure. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-16710 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a medium severity with a CVSS score of 5.8.
CVE-2026-16709 is a cross-site scripting (XSS) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary JavaScript in another user's browser session by injecting script content through improperly neutralized user input when a web page is updated.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 and 10.0.8.0 through 10.0.8.12 contain a path traversal vulnerability. This flaw allows a remote attacker with limited privileges to craft a URL request that can access files outside the intended directories on the system. The vulnerability could lead to unauthorized disclosure of arbitrary files.
CVE-2026-108178 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves an improperly implemented security check that can cause token validation to be incomplete, allowing a token to be accepted for unintended purposes.
CVE-2026-105459 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper verification of cryptographic signatures, where a token can be accepted without full signature validation. This flaw could allow an attacker to gain unauthorized access to an organization by joining it without a valid invitation.
CVE-2026-105002 is a high-severity code injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows arbitrary code execution by the management service when certain non-default configurations enable evaluation of customization content as code without proper restrictions.
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the target site's theme to register a color_scheme field on the user profile via Redux_Users::set_profile(), which causes the nonce to be rendered on /wp-admin/profile.php for every logged-in user, making it accessible to Subscribers.
The Affiliate Program Suite — SliceWP Affiliates WordPress plugin is affected by a SQL Injection vulnerability via the 'email' parameter in all versions up to and including 1.2.14. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient input escaping and lack of proper query preparation. The vulnerability is triggered during WooCommerce My Account registration through a guest-accessible nonce, enabling data extraction from the database without requiring authentication.
Tutor LMS plugin for WordPress up to version 4.1.2 has an authorization bypass vulnerability due to missing validation on a user-controlled key. Authenticated users with subscriber-level access and a valid API key can access paid course content without enrollment, retrieve quiz answers, and enumerate sensitive user information including instructors and administrators.
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that at least one prior comment from the attacker's name and email pair has been approved under WordPress's default comment_previously_approved moderation setting, and that a secondary language is configured in TranslatePress.
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.
The Stop Spammers Classic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' POST parameter in versions up to, and including, 2026.6. An unauthenticated POST handled on init stores the attacker-supplied author field (after sanitize_text_field, which does not escape single quotes) into the ss_stop_sp_reg_stats option history. The Log Report admin page then renders that stored value inside a single-quoted JavaScript string within a double-quoted onclick attribute using esc_js(); because esc_js() uses _wp_specialchars with ENT_COMPAT it does not escape single quotes, allowing the stored value to break out of the JS string literal and inject arbitrary JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever an administrator with manage_options access clicks the 'Report to SFS' link on an attacker-poisoned log row (the StopForumSpam API key must be configured for that link to be rendered — the field is empty by default). Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_block_style' endpoint in all versions up to, and including, 3.19.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author/<slug>/, which is accessible to unauthenticated visitors regardless of whether the attacker has published any posts.
IBM Aspera Faspex versions 5.0.0 through 5.0.19 contain an authorization vulnerability that allows an authorized user to bypass normal user restrictions and gain full administrative privileges. This flaw is classified as CWE-863 (Incorrect Authorization) and has a critical severity rating with a CVSS score of 9.8.