CLSA-2026-1792542243 TuxCare security update for @babel/helper-validator-identifier (1 CVE)

TuxCare rebuilt @babel/helper-validator-identifier to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792542242 TuxCare security update for @babel/helper-validator-identifier (1 CVE)

TuxCare rebuilt @babel/helper-validator-identifier to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792542240 TuxCare security update for @babel/helper-validator-identifier (1 CVE)

TuxCare rebuilt @babel/helper-validator-identifier to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

CLSA-2026-1792542241 TuxCare security update for @babel/helper-validator-identifier (1 CVE)

TuxCare rebuilt @babel/helper-validator-identifier to address 1 CVE. Fixed in 7.29.0-tuxcare.2...

CLSA-2026-1792542239 TuxCare security update for @babel/helper-validator-identifier (1 CVE)

TuxCare rebuilt @babel/helper-validator-identifier to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

CLSA-2026-1792542238 TuxCare security update for @babel/helper-validator-identifier (1 CVE)

TuxCare rebuilt @babel/helper-validator-identifier to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

PT-2026-120474

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment...

Linux Distros Unpatched Vulnerability : CVE-2026-112939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacke...

Use of Multiple Resources with Duplicate Identifier

Overview Affected versions of this package are vulnerable to Use of Multiple Resources with Duplicate Identifier via trybreakexpiredlock and trybreakstalelock in api.py and lease.py, where an attacker with write access to the lock directory can replace a held lock file with a symlink pointing at ...

CVE-2026-113676

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

EUVD-2026-105092

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113676

Froxlor versions 0.10.0 before 2.3.15 are vulnerable to an authorization bypass in the Admins.get API command. This vulnerability is caused by identifier confusion , allowing authenticated resellers to read sensitive records belonging to other administrators. By providing their own loginname comb...

CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

DEBIAN-CVE-2026-112939

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

CLSA-2026-1777481470 glibc: Fix of 7 CVEs

CVE-2021-3326: fix assertion failure in iconv ISO-2022-JP-3 module...

CVE-2026-112071

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

CVE-2026-112071

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

PT-2026-118308

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...