CVE-2026-79630

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...

EUVD-2026-70904

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...

CVE-2026-79630

The WPFunnels WordPress plugin prior to 3.13.0 contains an unauthenticated price manipulation vulnerability in its checkout order-bump feature. The plugin fails to verify that the product ID submitted via an order bump matches the product for which the bump's discount was configured. An unauthent...

CVE-2026-79630 WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...

CVE-2026-81288

Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...

EUVD-2026-69924

Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...

CVE-2026-81288

CVE-2026-81288 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the Upsell Order Bump Offer for WooCommerce WordPress plugin, affecting versions 3.1.5 and below . The CVSS v3.1 score is 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L , indicating a network-based attack...

CVE-2026-81288 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...

WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Upsell Order Bump Offer for WooCommerce versions = 3.1.5...

java-21-openjdk security update

1:21.0.12.1.1-1.2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.12.1.1-1.2 - Bump release for PQC build - Related: RHEL-235625 1:21.0.12.1.1-1.1 - Update to jdk-21.0.12.1+1 GA - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - This...

GO-2026-4588 vulnerabilities

Vulnerabilities for packages: dl, wolfictl, cg, apply-cve-bump...

GO-2026-5019 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, chisel-fips, kyverno-fips, tflint-fips, k3s, crossplane-provider-azure-purview, crossplane-provider-azure-storage, spire-server, gptscript, argo-workflows, kubernetes, crossplane-provider-azure-network, prometheus-mongodb-exporter, rootlesskit,...

buildah security update

1.43.1-4.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117178 2:1.43.1-4 - rebuild for CVE-2026-39822 - Resolves: RHEL-193643 2:1.43.1-3 - bump golang.org/x/crypto to v0.52.0 to fix CVE-2026-39830 - Resolves: RHEL-186266 2:1.43.1-2 - Rebuild for CVE-2026-25679 -...

yggdrasil security update

0.4.9.2-1 - Update yggdrasil to 0.4.9.2 0.4.9.1-1 - Update yggdrasil to 0.4.9.1 0.4.9-5 - Bump release for rebuild 0.4.9-4 - Bump release for rebuild 0.4.9-3 - Bump release for rebuild...

yggdrasil security update

0.4.9.2-1 - Update yggdrasil to 0.4.9.2 0.4.9.1-1 - Update yggdrasil to 0.4.9.1 0.4.9-5 - Bump release for rebuild 0.4.9-4 - Bump release for rebuild 0.4.9-3 - Bump release for rebuild...

yggdrasil-worker-package-manager security update

0.2.3-7 - Bump release for rebuild 0.2.3-6 - Bump release for rebuild...

delve security update

1.26.1-2.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.26.1-2 - Bump...

yggdrasil-worker-package-manager security update

0.2.3-7 - Bump release for rebuild 0.2.3-6 - Bump release for rebuild...

poppler security update

24.02.0-7.el102.2 - Fix integer overflow in tilingPatternFill CVE-2026-10118 - Bump NVR for MR - Resolves: RHEL-180565 24.02.0-7.el102.1 - Fix integer overflow in tilingPatternFill CVE-2026-10118 - Resolves: RHEL-180565...

MAL-2026-10636 Malicious code in leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b0bed6337ffe527af2615fed8ae1ecbb449f6a6cb00afa6381f7811ec88956 [email protected] ships src/poc/index.js which uses childprocess.exec to run a shell pipeline that collects host reconnaissance data hostname,...