CVE-2026-70466

Technical details about CVE-2026-70466 are not publicly available in the provided documents. Monitor Fortinet advisories for updates on affected FortiWeb versions, impact scope, and remediation.

CVE-2026-70466

A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via...

EUVD-2026-57192

A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via...

CVE-2026-16990

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-15045

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkou...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to Elasticsearch control headers lacking the Camel prefix and therefore bypassing Camel's inbound HTTP header filtering, which allows an unauthenticated attacker to inject user-controlled headers and override...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2022-4994: KVM: x86: wean fast IN from emulatorpioin bsc1273097. CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1255616. CVE-2024-38542: RDMA/manaib:...

EUVD-2026-57177

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

CVE-2026-17008

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid...

CVE-2026-16990 Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-16990

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-16990

The CVE concerns the WordPress plugin “Payment Button for PayPal” (versions up to 1.2.3.44). The root cause is that the plugin does not enforce the merchant-configured price server-side and trusts the amount provided by the client, enabling unauthenticated attackers to create a real PayPal order ...

EUVD-2026-57172

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to improper inbound filtering of SQS message attributes, which allows an attacker who can send messages to the SQS queue to inject arbitrary Camel control headers, potentially influencing downstream producers such a...

Improper Input Validation

Apache Camel JIRA component is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of JIRA control headers, where attacker-controlled HTTP headers can override configured issue keys, project keys, transitions, and other operation parameters, allowing...

Security Bulletin:Vulnerability in Spring MVC affects IBM Netezza Appliance

Summary The Spring MVC package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41846 Vulnerability Details CVEID:CVE-2026-41846 DESCRIPTION: Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle...

Improper Input Validation

Apache Camel Kafka component is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of Kafka control headers, where attacker-controlled kafka. headers can override the configured Kafka topic, partition, or timestamp, allowing unauthorized message redirecti...

Improper Input Validation

Apache Camel Salesforce is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of Salesforce control headers, where attacker-controlled HTTP headers can override configured SOQL queries, SObject parameters, or Apex REST requests, allowing unauthorized acce...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...