SUSE CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

CVE-2026-27539

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

EUVD-2026-57937

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27539 WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27539

CVE-2026-27539 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Welcart e-Commerce plugin, versions

CVE-2026-27539 WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

PT-2026-71703

Name of the Vulnerable Software and Affected Versions Zalktis versions prior to 2026.1.586 Zalktis versions prior to 2026.2.592 Description An issue exists where the application concatenates partner-controlled values directly into SQL statement text during the import of received electronic invoic...

PT-2026-71697

Name of the Vulnerable Software and Affected Versions Hongjing e-HR affected versions not specified Description An unauthenticated SQL injection exists in the 'getSdutyTree' servlet endpoint. Remote attackers can bypass the oauthservlet authentication filter by using a path traversal sequence in...

VulnCheck KEV: CVE-2024-58374

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attacke...

CVE-2024-58374: Improper Neutralization of Special Elements used in an SQL Command

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attacke...

PT-2026-71502

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27539: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

Malicious code in @years19/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b Package presents itself as an n8n community utility node, but the shipped node file nodes/PwnNode.node.js is a 213-byte stub. The real behavior is in...

MAL-2026-13913 Malicious code in @years20/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89d61386ef6d8694ecf5f0578b5fe77156f475f76a8e97a1b2e834821cfbe0df The package presents as an n8n community-nodes helper but ships a malicious postinstall script callback.js and a byte-identical main entrypoint...

Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

MAL-2026-13874 Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

MAL-2026-13851 Malicious code in @years18/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70df151b0a3f6d74618b466c9d7ac91e18389b38a805e2010b55202b5722330 On npm install, this package auto-runs callback.js via a postinstall hook and repeats the same behavior in index.js on require. The script shells out...

CVE-2026-15213

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or...

CVE-2026-15213 Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or...

CVE-2026-15213

The CVE concerns the Welcart e-Commerce WordPress plugin prior to 2.11.33. The vulnerability lies in the settlement callback for convenience-store/bank-transfer payments, where there is no authenticity verification. An unauthenticated request can flip an order from unpaid to settled using only an...