CVE-2026-67278

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887 Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress (versions up to 2.12.1 ) is vulnerable to PHP Object Injection via the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary serialized data as order metadata during a public checkout, then trigger...

CVE-2026-19887 Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

EUVD-2026-71883

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887: Deserialization of Untrusted Data

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability

Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability discovered by daroo in WordPress Plugin Welcart e-Commerce versions = 2.12.1...

CVE-2026-84045

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

CVE-2026-84045 E-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cart

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

EUVD-2026-70993

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

CVE-2026-84045 E-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cart

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

CVE-2026-84045

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin, in versions before 2.0.5 , fails to validate client-supplied trip distance and base-price values on the server before pricing a booking. This allows unauthenticated attackers to manipulate the order total down to zero and place real...

PT-2026-85471

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

CVE-2026-84045: Undefined Security Weakness

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

PT-2026-86453

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 6.49.21 MikroTik RouterOS versions prior to 7.23.4 MikroTik RouterOS versions prior to 7.24.2 Description RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Due to the inclusion of...

CVE-2026-18765

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection. This issue affects E-OSB: before V02.26.07.08.01...

CVE-2026-18765 SQL Injection in Teracity Sotware's Teracity E-OSB Platform

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection. This issue affects E-OSB: before V02.26.07.08.01...