Malicious code in saeka (PyPI)

Source: kam193 67507c9821e48c6f8284a142ae4788a9624ea608f782bf254573dae4936e7a04 The package is a mass credit card checker: it checks if credit card data are real and active by abusing real online retail services. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-17877 Malicious code in saeka (PyPI)

When a user invokes the card-checking feature, saeka sends the supplied card number, expiration month and year, and CVV as a single value to https://uncoder.eu.org/cc-checker/api.php using an HTTP POST. The package description does not disclose this external recipient or the transfer of complete...

Malicious code in saeka (PyPI)

When a user invokes the card-checking feature, saeka sends the supplied card number, expiration month and year, and CVV as a single value to https://uncoder.eu.org/cc-checker/api.php using an HTTP POST. The package description does not disclose this external recipient or the transfer of complete...

CVE-2026-94360 Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed...

CVE-2026-94360

The Paymentfor Gateway for WooCommerce WordPress plugin, in versions prior to 1.0.6 , is vulnerable to an unauthenticated order payment forgery . The root cause is a failure to verify the authenticity of inbound payment notifications before updating an order's status to paid. This allows unauthen...

CVE-2026-83584

Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally...

CVE-2026-83579

Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally...

CVE-2026-83579

A heap-based buffer overflow exists in the Windows Smart Card component. This vulnerability allows an authorized attacker to achieve local privilege escalation . No specific software versions, root causes, or exploit details are provided in the documents, but an official fix is indicated by the r...

CVE-2026-83584

A Use after free vulnerability exists in Windows Smart Card , which allows an authorized attacker to achieve local privilege escalation . The vulnerability is categorized under CWE-416 . No specific affected versions, root causes, or exploit details are provided in the documentation. Remediation ...

DEBIAN-CVE-2026-109944

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later looks up the deleted parent context and reaches a terminating WINPRASSERT. A malicious RDP server can crash a connecting client with...

Windows Smart Card Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally...

Windows Smart Card Elevation of Privilege Vulnerability

Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally...

CVE-2026-109403

A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the...

CVE-2026-109403 conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery

A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the...

CVE-2026-109403

The conductor-oss conductor software (up to version 3.32.5 ) is vulnerable to Server-Side Request Forgery (SSRF) in the Agent Card Fetching component. The flaw exists within the A2AService.getAgentCard function located in the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java...

BIT-GHOST-2026-105651 Ghost: Stored XSS via Bookmark Card Images

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-108942

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function createhtmlforitem of the file modules/uiextranetworks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description result...

CVE-2026-108942 philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function createhtmlforitem of the file modules/uiextranetworks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description result...

EUVD-2026-98181

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function createhtmlforitem of the file modules/uiextranetworks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description result...

CVE-2026-108942

A security flaw exists in philz1337x clarity-upscaler (up to commit cfbdb842c6c839c8e97741722b8cf9a4b7662d98) within the Extra Networks Card Rendering component. The root cause is improper neutralization of input in the create_html_for_item function of the modules/ui_extra_networks.py file, where...