CVE-2026-12654 Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...

CVE-2026-12654

CVE-2026-12654 affects Payment Plugins for Stripe WooCommerce (WordPress)

CVE-2026-12654 Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...

CVE-2026-12689

The ProfileGrid WordPress plugin (versions before 5.9.9.7 ) is vulnerable to an authorization bypass because it fails to perform ownership checks on certain private-message thread actions. This allows authenticated users with Subscriber-level access or higher to perform unauthorized actions on ot...

SUSE CVE-2026-56684

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...

PT-2026-64239

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' priva...

CVE-2026-16807

creationtimestamp| type| source ---|---|--- 2026-07-23 22:42:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116971701809054544 2026-07-24 02:05:03+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrebai6xxb2l 2026-07-24 12:45:38+00:00| seen|...

CVE-2026-16806

creationtimestamp| type| source ---|---|--- 2026-07-23 22:28:24+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116971648043364212 2026-07-24 11:00:58+00:00| seen| https://infosec.exchange/users/dragonjar/statuses/116974607274777234 2026-07-24 12:45:41+00:00| seen|...

CVE-2026-16805

creationtimestamp| type| source ---|---|--- 2026-07-23 22:15:23+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116971596854729313 2026-07-24 12:45:43+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-64 2026-07-24 13:30:23+00:00| seen|...

CVE-2026-49035 Stack-based Buffer Overflow in MZ Automation libIEC61850

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution RCE has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled...

WordPress Payment Plugins for Stripe WooCommerce plugin <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Order Status Modification vulnerability discovered by gidget smith in WordPress Plugin Stripe For WooCommerce versions = 4.0.7...

CVE-2026-62493

creationtimestamp| type| source ---|---|--- 2026-07-23 18:20:13+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-61162

creationtimestamp| type| source ---|---|--- 2026-07-23 18:16:24+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60778

creationtimestamp| type| source ---|---|--- 2026-07-23 17:46:52+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60175

creationtimestamp| type| source ---|---|--- 2026-07-23 16:47:21+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-65916

CyberPanel up to version 1.9.1 contains a missing authorization vulnerability in the cancelBackupCreation handler. An authenticated user can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt ba...

MINI-2CVG-2PFM-G4CR

Bulletin has no description...

CVE-2026-59544

creationtimestamp| type| source ---|---|--- 2026-07-23 13:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvlzdlq22s...

CVE-2026-59543

creationtimestamp| type| source ---|---|--- 2026-07-23 13:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvii4pva2q...

PYSEC-2026-3475 LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

Summary When LightRAG is deployed with LIGHTRAGAPIKEY set but AUTHACCOUNTS unset an officially documented "API-Key authentication" mode, the X-API-Key protection can be bypassed by any remote unauthenticated attacker. The bypass does not require network contact with the victim server — an attacke...