CVE-2026-18603

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clea...

CVE-2026-18603

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clea...

CVE-2026-18603

CVE-2026-18603 affects the PiWeb Cancel order/Refund plugin for WooCommerce (WordPress) prior to version 1.3.4.34. The root cause is missing authorization/ownership checks when adding the contents of a previous order to the cart, enabling unauthenticated users to disclose other customers’ order c...

CVE-2022-2200

creationtimestamp| type| source ---|---|--- 2026-08-09 04:23:36+00:00| seen| https://t.me/onelab1337/2324 2026-08-10 00:00:29+00:00| published-proof-of-concept| https://t.me/onelab1337/2324...

CVE-2026-15734

creationtimestamp| type| source ---|---|--- 2026-08-09 04:14:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msmpvxduao2o...

CVE-2026-17510

creationtimestamp| type| source ---|---|--- 2026-08-09 02:31:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2za2ogj6oc6pd 2026-08-12 20:02:27+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3msvwck3zmw2r...

CVE-2018-1281

creationtimestamp| type| source ---|---|--- 2026-08-09 01:45:26+00:00| seen| https://gist.github.com/konard/1c35fbf768bf4b7952f94331be18ee5a...

CVE-2026-71991

creationtimestamp| type| source ---|---|--- 2026-08-09 01:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msmf3yogwh2y...

CVE-2026-71993

creationtimestamp| type| source ---|---|--- 2026-08-09 00:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msmctj6fur2q 2026-08-09 01:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/117062960952906332 2026-08-09 01:30:30+00:00| seen|...

CVE-2026-15257

creationtimestamp| type| source ---|---|--- 2026-08-08 20:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mslv7c4uaq2i 2026-08-09 16:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msnyb3cao62a...

CVE-2026-13330

creationtimestamp| type| source ---|---|--- 2026-08-08 19:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mslru2eia72i...

CVE-2026-71958

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71955

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resultin...

CVE-2026-71954

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in...

CVE-2026-71948

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71951

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

CVE-2026-71949

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in...

CVE-2026-71950

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the actionvalue field, resulting in command execution...

CVE-2026-71945

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71947

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in...