CVE-2026-11855

The Simple Membership WordPress plugin (versions

CVE-2026-11855: Undefined Security Weakness

The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web...

CVE-2025-53392

CVE-2025-53392 : In pfSense CE 2.8.0, the WebCfg - Diagnostics: Command privilege allows an authenticated user to download/read arbitrary files via a directory traversal in diag_command.php (dlPath). This is a local file-disclosure vulnerability, with evidence of PoC/exploit activity (e.g., publi...

Shopify: Accessing Payments page and adding payment methods with limited access accounts

Users with the Orders permission were allowed to see the store's payment gateway information. This page should have been restricted to users with the Settings permission only. Using this vulnerability a User with limited access/ No access to Settings could add/alter/change Payment settings while...