CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-14821

creationtimestamp| type| source ---|---|--- 2026-07-28 08:14:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mroxqr2z7y2e...

CVE-2026-15673 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...

CVE-2026-15673

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...

CVE-2026-15673

CVE-2026-15673 affects the WordPress plugin “SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery” up to version 3.9.7. It is a second‑order SQL Injection where insufficient escaping in the update_option‑stored values in checkout_payment_plans and order_status allo...

EUVD-2026-49712

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...

CVE-2026-15671

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to and including 3.9.7, due to insufficient escaping of the user-supplied parameter and inadequate...

CVE-2026-15671 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-15671

The CVE-2026-15671 entry concerns the WordPress plugin “SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery” (versions ≤ 3.9.7). It describes a generic SQL Injection via the id parameter caused by insufficient escaping and lack of proper query preparation in an ex...

EUVD-2026-49711

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-49709

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billingphone parameter. This is due to the processRegistration...

CVE-2026-64716

creationtimestamp| type| source ---|---|--- 2026-07-28 04:52:39+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260728 2026-07-28 08:48:27+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1984 2026-07-28 17:16:38+00:00| seen|...

CVE-2026-43780

creationtimestamp| type| source ---|---|--- 2026-07-28 04:50:36+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260728 2026-07-28 17:18:35+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15 2026-07-30 16:01:01+00:00|...

CVE-2026-39873

creationtimestamp| type| source ---|---|--- 2026-07-28 04:47:08+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260728 2026-07-28 16:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrpto4ua4t2u 2026-07-28 17:22:03+00:00| seen|...

PT-2026-65403

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billing phone parameter. This is due to the processRegistration...

CVE-2026-17574

creationtimestamp| type| source ---|---|--- 2026-07-27 20:15:06+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-17574...

CVE-2026-13597

creationtimestamp| type| source ---|---|--- 2026-07-27 16:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnbjklh6g24...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

CVE-2026-64213

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Add lock protection to lm90alert Sashiko reports: lm90alert executes in the smbus alert context and calls lm90updateconfreg to disable the hardware alert line, without acquiring hwmonlock. Concurrently, sysfs write...