CVE-2026-19213

A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function undoneqty in the library src/WtCore/TraderAdapter.h of the component Pending Order Handler. The manipulation of the argument getUndoneQty leads to enforcement of behavioral workflow. The attack is possible to be...

EUVD-2026-54559

A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function undoneqty in the library src/WtCore/TraderAdapter.h of the component Pending Order Handler. The manipulation of the argument getUndoneQty leads to enforcement of behavioral workflow. The attack is possible to be...

SQLi (SQL Injection) org.hibernate:hibernate-core-jakarta Dependency in Bamboo Data Center

This High severity SQLi SQL Injection vulnerability was introduced in version 12.1.0 of Bamboo Data Center. This SQLi SQL Injection vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L allows an authenticated attacker to forward a malicious que...

CVE-2026-9169

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...

CVE-2026-15211 Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-15211

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-15211 Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-15211

Technical details about CVE-2026-15211 are not publicly available in the provided documents; monitor for updates.

CVE-2026-16039 MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...

CVE-2026-16038 MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services...

CVE-2026-16039

The MStore API WordPress plugin, in versions prior to 4.21.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to restrict its vendor-orders endpoint to the caller's own records, which allows any authenticated user—including those with Subscriber privileges—to view ...

CVE-2026-16039 MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...

EUVD-2026-54182

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator tsl/src/compression/algorithms/dictionary.c. The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds,...

EUVD-2026-54308

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

EUVD-2026-54302

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid...

PT-2026-68867

Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.0 Description The MStore API WordPress plugin fails to verify payment status with the payment gateway before marking an order as paid on several payment-completion endpoints. This allows an unauthenticated...

CVE-2026-9169: Uncontrolled Search Path Element

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...

PT-2026-69084

Name of the Vulnerable Software and Affected Versions WonderTrader versions prior to 1.0.0 Description A remote issue exists in the Pending Order Handler component within the src/WtCore/TraderAdapter.h library. Manipulation of the getUndoneQty argument in the undone qty function allows an attacke...

CVE-2026-15211: Insufficient Verification of Data Authenticity

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

PT-2026-68876

Name of the Vulnerable Software and Affected Versions Subscriptions for WooCommerce versions prior to 2.0.1 Description An issue exists in the WooCommerce order-received flow where the plugin fails to validate the payment amount or bind the PayPal order token to the order being completed. The...