CVE-2026-43643

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

EUVD-2026-84624

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-43643

Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0 are susceptible to an authorization bypass vulnerability in the billing module handler. An unauthenticated remote attacker can modify any tenant's account balance by sending a POST request to the admin panel dispatcher with crafted...

CVE-2026-43643 Softaculous Virtualizor Authorization Bypass via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-43643 Softaculous Virtualizor Authorization Bypass via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

PT-2026-96922

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 Patch 9 Softaculous Virtualizor version 3.0.0 Description An authorization bypass exists in the billing module handler. Unauthenticated remote attackers can modify any tenant's account balance by...

CVE-2026-43643: Missing Authorization

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition via the doUpgrade process. An attacker can inflate their credit balance by sending multiple concurrent downgrade requests, resulting in multiple refunds for a single legitimate downgrade. Remediation Upgrade...

CVE-2026-91953

FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in negosendnegotiationrequest that fails to validate the LBLOADBALANCEINFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an...

PT-2026-92072

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0 Description A heap buffer overflow occurs in the nego send negotiation request function due to a failure to validate the length of the LB LOAD BALANCE INFO field before writing it to a fixed 512-byte buffer. A...

Astra Linux – Vulnerability in Linux, Linux 5.10

A vulnerability related to deallocation was discovered in the preparetorelocate function in fs/btrfs/relocation.c within btrfs in the Linux Kernel. This potential flaw can be triggered by calling btrfsioctlbalance before calling btrfsioctldefrag...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: fixed a NULL pointer dereference when attempting to start a new transaction. BUG Syzbot reported a NULL pointer dereference, accompanied by a crash: FAULTINJECTION: Forced a failure. starttransaction+0x830/0x1670...

EUVD-2026-74703

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value...

CVE-2026-75861

The Ultimate Gift Cards for WooCommerce WordPress plugin (versions before 3.2.10 ) is vulnerable to a Broken Access Control flaw. The plugin fails to verify if a user redeeming a gift card is the intended recipient. This allows any authenticated user , such as a subscriber, to redeem gift cards b...

CVE-2026-75861: Missing Authorization

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value...

CVE-2026-86724

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-86724 AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-86724 AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

EUVD-2026-72860

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-86724

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a cross-site request forgery (CSRF) vulnerability in plugin/YPTWallet/view/saveBalance.php . The flaw arises because the endpoint relies solely on session cookies without token validation , allowing an attacker to craft a m...