CVE-2026-92428 Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or complete...

CVE-2026-92428

The Rede Itaú for WooCommerce WordPress plugin, in versions prior to 5.5.3 , is vulnerable to unauthenticated order status manipulation. The root cause is a failure to verify the authenticity of a payment gateway webhook before updating an order's status. This allows an unauthenticated attacker t...

CLEANSTART-2026-FT30855 node-tar is a tar archive manipulation library for Node

CVE-2026-73566 affects multiple packages. node-tar is a tar archive manipulation library for Node. See references for individual vulnerability details...

CLEANSTART-2026-RB55722 node-tar is a tar archive manipulation library for Node

CVE-2026-59874 affects multiple packages. node-tar is a tar archive manipulation library for Node. See references for individual vulnerability details...

PT-2026-114790

Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7...

PT-2026-114791

Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa...

CVE-2026-110874: Deserialization of Untrusted Data

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-110934: Improper Validation of Array Index

Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa...

CVE-2026-110933: Uncaught Exception

Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7...

PT-2026-115090

Attackers converted grocery store refrigeration systems into heating units, reaching 50°C 120°F across 400+ European stores. They exploited Internet-exposed Danfoss controllers via CVE-2024-41450/41451/41452, then moved laterally through OT networks to coordinate simultaneous temperature...

PT-2026-115028

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional data array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...

CVE-2026-76182

In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the...

PT-2026-115124

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when json decode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

PT-2026-115015

Name of the Vulnerable Software and Affected Versions Nuxt OG Image versions 6.2.5 through 6.6.x Description An unauthenticated attacker can perform content spoofing by manipulating the cache of Open Graph images. The dynamic endpoint / og/d/.png accepts unsigned requests, and the...

CVE-2026-55381

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/estimate/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does...

Samsung Vyond has vulnerabilities due to improper exception handling.

Samsung Vyond has a vulnerability related to improper exception handling. This vulnerability arises from uncaptured exceptions, which may lead to manipulation of input data...

CVE-2026-94254

The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing...

CVE-2026-94254 SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter

The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing...

CVE-2026-94254

The SellKit WordPress plugin (versions before 2.8.0 ) is vulnerable to unauthenticated arbitrary price manipulation . The flaw occurs because the plugin fails to validate client-supplied product prices during checkout total recalculations. An unauthenticated attacker can exploit this by using the...

WordPress SellKit plugin < 2.8.0 - Unauthenticated Arbitrary Price Manipulation vulnerability

Unauthenticated Arbitrary Price Manipulation vulnerability discovered by Lê Gia Khôi in WordPress Plugin SellKit versions 2.8.0...