Unauthenticated attackers can delete server files and read data via a path traversal flaw in the PPOM WooCommerce plugin, risking full site compromise.
A critical flaw in TinaCMS preview logic lets attackers frame external sites and execute GraphQL mutations using editor credentials.
The National Vulnerability Database has assigned a CVSS 9.8 score to an object injection vulnerability in the ThemeREX Gutentype WordPress plugin.
Microsoft assigns a high severity score to an information disclosure vulnerability in its cloud API management service that permits unauthorised network access.
A critical memory corruption bug in IBM DataPower Gateway allows remote attackers to execute arbitrary code across multiple major release branches.
A critical flaw in Integrics Enswitch permits attackers to reset user passwords without credentials, enabling full account takeover through username enumeration.