CVE-2026-93628

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the...

WordPress Wava Payment Plugin plugin 0.3.1-0.3.9 - Unauthenticated Order Status Change vulnerability

Unauthenticated Order Status Change vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Wava Payment versions 0.3.1-0.3.9...

CVE-2026-87837

The Wava Payment Plugin for WordPress (versions before 0.3.10 ) is vulnerable to an unauthenticated order status change due to a failure to verify the authenticity of incoming payment-provider notifications. An unauthenticated attacker can manipulate any WooCommerce order status, such as marking ...

CVE-2026-87837 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

CVE-2026-87837 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

PT-2026-120482

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

CVE-2026-94272

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

EUVD-2026-104106

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272

The Snap Finance WordPress plugin versions before 3.12.0 is vulnerable to an authentication bypass. The plugin fails to verify that requests to change a WooCommerce order's status originate from an authorized source. This allows unauthenticated attackers to manipulate order states, such as moving...

WordPress Snap Finance plugin 1.0.8-3.11.0 - Unauthenticated Arbitrary Order Status Change vulnerability

Unauthenticated Arbitrary Order Status Change vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Snap Finance versions 1.0.8-3.11.0...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

PT-2026-117256

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-97851

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...

CVE-2026-97851 J4Care dcm4che Missing Authorization

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...

CVE-2026-97851 J4Care dcm4che Missing Authorization

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...

CVE-2026-97851

The J4Care dcm4che software contains a Missing Authorization vulnerability (CWE-862) within its storage status-change REST service . An attacker can modify location records associated with DICOM instances to a TO_DELETE state. This action triggers the PurgeStorageScheduler to delete the reference...

CVE-2026-97851

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...

EUVD-2026-102890

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...

CVE-2026-97851: Missing Authorization

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...