JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons...

CLSA-2026-1791584939 TuxCare security update for marked (1 CVE)

TuxCare rebuilt marked to address 1 CVE. Fixed in 4.0.8-tuxcare.3...

EUVD-2026-92965

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

CLSA-2026-1790807470 TuxCare security update for marked (2 CVEs)

TuxCare rebuilt marked to address 2 CVEs. Fixed in 2.1.3-tuxcare.1...

marked-sanitizer (0.0.0) potentially affected by CVE-2026-102342 via ammonia (3.1.4)

ammonia CARGO version 3.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on ammonia and may be impacted: - marked-sanitizer 0.0.0 Source cves: CVE-2026-102342 Source advisory: OSV:GHSA-M6MH-2HW2-555X...

PT-2026-97275

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

CVE-2026-91017 Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...

Astra Linux – Vulnerability in node-marked

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch might cause catastrophic backtracking for certain strings, leading to a denial of service DoS attack. Any user who runs untrusted markdown using a vulnerable version of Marked, without...

List of Security Fixes and Improvements in Veeam Plug-in for AWS

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Plug-in for AWS. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases. Security Fixes a...

CVE-2026-84043: Insufficient Verification of Data Authenticity

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...

ROOT-APP-NPM-CVE-2022-21681 CVE-2022-21681 in marked - Patched by Root

Root has patched CVE-2022-21681 in the marked package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-21680 CVE-2022-21680 in marked - Patched by Root

Root has patched CVE-2022-21680 in the marked package for Root:npm. Multiple fixed versions available...

CVE-2026-73479 dua-cli Terminal Escape Sequence Injection via Marked Paths

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...

CVE-2026-68136

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...

CVE-2026-17012 Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_email

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...

CVE-2026-15211 Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-15211

Technical details about CVE-2026-15211 are not publicly available in the provided documents; monitor for updates.

EUVD-2026-54400

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-16038 MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services...

EUVD-2026-54190

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...