airbyte-source-jira (>=3.4.0.dev202412051939, <=3.4.0.dev202412052135), airbyte-source-klaviyo (>=2.11.0.dev202411212104, <=2.11.3.dev202412021626) +1 more potentially affected by CVE-2026-50271 via ddtrace (2.16.4)

ddtrace PYPI version 2.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - airbyte-source-jira =3.4.0.dev202412051939, =2.11.0.dev202411212104, =5.14.0.dev202506051219, =5.14.0.dev202506111019 Source cves: CVE-2026-50271...

airbyte-source-jira (>=3.4.0.dev202412051939, <=3.4.0.dev202412052135), airbyte-source-klaviyo (>=2.11.0.dev202411212104, <=2.11.3.dev202412021626) +1 more potentially affected by CVE-2026-50271 via ddtrace (2.16.4)

ddtrace PYPI version 2.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - airbyte-source-jira =3.4.0.dev202412051939, =2.11.0.dev202411212104, =5.14.0.dev202506051219, =5.14.0.dev202506111019 Source cves: CVE-2026-50271...

CVE-2026-10628

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-10628 Points and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-10628

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

EUVD-2026-43123

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-10628

The CVE concerns the WordPress plugin Points and Rewards for WooCommerce (affected: all versions up to 2.10.0). It describes an authorization bypass in which authenticated users with subscriber-level access and above can perform arbitrary modifications via multiple AJAX actions. Core implications...

CVE-2026-10628 Points and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-10628: Missing Authorization

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-57374

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

WS-2021-0130

Klaviyo Magento 2 before 3.0.0 allows reading private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API...

Best Klaviyo Alternatives for Revenue Growth and Advanced Analytics

Top Klaviyo alternatives offer advanced analytics, automation, and insights to help e-commerce brands improve campaigns, boost revenue, and track performance...

CVE-2023-25456

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Klaviyo, Inc. Klaviyo plugin = 3.0.7 versions...

EUVD-2023-29411

Malicious code in bioql PyPI...

EUVD-2023-12865

Malicious code in bioql PyPI...

CVE-2023-0874

The Klaviyo WordPress plugin before 3.0.10 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Malicious code in careers.klaviyo.com (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3382 Malicious code in careers.klaviyo.com (npm)

--- -= Per source details. Do not edit below this line.=-...

Unauthorized Data Access

Klaviyo Magento 2 is vulnerable to Unauthorized Data Access. The vulnerability is due to insufficient access controls in an endpoint, allowing attackers to read private customer data from stores by reclaiming guest-carts and accessing order details via the Magento API...

Read private customer data reclaiming carts in Klaviyo Magento

A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API...