EUVD-2026-60055

A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the file /customer/account/rma/update-status of the component RMA State Validation. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated...

CVE-2026-19993

Webkul Bagisto (up to 2.4.4) contains a vulnerability in the RMA State Validation flow, specifically the /customer/account/rma/update-status endpoint. An attacker may remotely trigger manipulation of the behavioral workflow via this unknown functionality, with exploitation disclosed publicly. CVS...

CVE-2026-19993 Webkul Bagisto RMA State Validation update-status behavioral workflow

A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the file /customer/account/rma/update-status of the component RMA State Validation. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated...

CVE-2026-19995: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The...

PT-2026-73212

Name of the Vulnerable Software and Affected Versions Webkul Bagisto versions prior to 2.4.5 Description A remote attack is possible due to an issue in the RMA State Validation component. Manipulation of the /customer/account/rma/update-status endpoint leads to the enforcement of a behavioral...

PT-2026-73218

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the component Backend Sales RMA Endpoint. Performing a manipulation results in authorization bypass. The attack is possible to be carried out...

CVE-2026-19997: Authorization Bypass Through User-Controlled Key

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the component Backend Sales RMA Endpoint. Performing a manipulation results in authorization bypass. The attack is possible to be carried out...

CVE-2026-19993: Improper Enforcement of Behavioral Workflow

A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the file /customer/account/rma/update-status of the component RMA State Validation. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated...

PT-2026-73216

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The...

PT-2026-76884

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rma qty/resolution type/rma reason id results in enforcement of behavioral workflow. The attack may be performed from remote. The...

Malicious code in rma-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fcbaad039ecd69789daa0857a674926917f7a439656144587a9fc441968e97c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview rma-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-6872 Malicious code in rma-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fcbaad039ecd69789daa0857a674926917f7a439656144587a9fc441968e97c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2025:4196-1 Security update for grub2

This update for grub2 fixes the following issues: - CVE-2025-54770: Fixed missing unregister call for netsetvlan command may lead to use-after-free bsc1252930 - CVE-2025-54771: Fixed rubfileclose does not properly controls the fs refcount bsc1252931 - CVE-2025-61661: Fixed out-of-bounds write in...

CVE-2025-12086

The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the 'wpsrmacancelreturnrequest' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for...

EUVD-2024-18536

Malicious code in bioql PyPI...

EUVD-2025-21855

Malicious code in bioql PyPI...

EUVD-2022-2998

Malicious code in bioql PyPI...

CVE-2025-6222

The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'cedrnxorderexchangeattachfiles' function in all versions up to, and including, 3.2.6. This...

CVE-2025-6222 WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet <= 3.2.6 - Unauthenticated Arbitrary File Upload

The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'cedrnxorderexchangeattachfiles' function in all versions up to, and including, 3.2.6. This...