@julyware/clover-ui (>=0.1.0, <=0.1.2), @syncfusion/ej2-angular-a2ui (>=35.1.38, <=35.1.40) potentially affected by CVE-2026-92213 via @a2ui/angular (0.10.7)

@a2ui/angular NPM version 0.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on @a2ui/angular and may be impacted: - @julyware/clover-ui =0.1.0, =35.1.38, =35.1.40 Source cves: CVE-2026-92213 Source advisory: MEND:CVE-2026-92213...

Malicious code in clover-codelab-remote-pay-cloud (npm)

Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, and non-internal IPv4 address via os.userInfo, process.cwd,...

CVE-2026-66700

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

EUVD-2026-57906

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66700

CVE-2026-66700 affects the WordPress plugin “Smart Online Order for Clover” (versions &lt;= 1.6.1). The vulnerability is an Unauthenticated Cross Site Scripting (XSS) flaw reported for that plugin, indicating an attacker can inject scripts without authentication. Connected records confirm the aff...

CVE-2026-66700: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

MAL-2026-12353 Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

WordPress Clover Payment Gateway by Zaytech for WooCommerce plugin < 1.3.6 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin WooCommerce Clover Payment Gateway versions 1.3.6...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin (versions before 1.3.6 ) is vulnerable to an unauthenticated payment bypass . The flaw exists because the plugin fails to verify if an approved external payment record belongs to the specific WooCommerce order being completed,...

CVE-2026-12493 Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

CVE-2026-12493 Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

EUVD-2026-49067

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

CVE-2026-12493: Improper Authentication

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

PT-2026-64834

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

clover-synth (0.1.0), coliseum (1.0.5) +5 more potentially affected by CVE-2025-71176 via pytest (8.0.0rc2)

pytest PYPI version 8.0.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - clover-synth 0.1.0 - coliseum 1.0.5 - muograph =0.1.6, =2.1.0, =0.7.4, =0.12.1 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...

org.jenkins-ci.main:jenkins-test-harness (1.412), org.jenkins-ci.main:jenkins-war (1.412) +5 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.412)

org.jenkins-ci.main:jenkins-core MAVEN version 1.412 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.412 - org.jenkins-ci.main:jenkins-war 1.412 -...