305 matches found
AlmaLinux 9.2 [TuxCare] Security Update: squid (ALMALINUX9.2:CLSA-2024:1735126310)
The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1735126310 advisory. - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prio...
Malicious Package
Overview semver-bump-io is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-16453 Malicious code in semver-bump-io (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c66af9c077b6704b080c07e6aeca29f2f569668ee0bed678a9d370cc886051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in semver-bump-io (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c66af9c077b6704b080c07e6aeca29f2f569668ee0bed678a9d370cc886051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview semver-bump-io is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
osbuild-composer security update
101.5-1.0.1 - Bump to 101.5-1.0.1 - CVE-2026-32280 - CVE-2026-32282 - CVE-2026-32283 - CVE-2026-33186 - CVE-2026-34986...
Oracle Linux 10 / 8 / 9 : java-21-openjdk (ELSA-2026-42895)
The remote Oracle Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42895 advisory. 1:21.0.12.1.1-1.2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.12.1.1-1.2 - Bump release for PQC build - Related: RHEL-235625...
CVE-2026-79630
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
CVE-2026-79630 WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
EUVD-2026-70904
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
CVE-2026-79630 WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
CVE-2026-79630
The WPFunnels WordPress plugin versions prior to 3.13.0 is vulnerable to an unauthenticated price manipulation flaw. The root cause is a failure to verify that a product requested through a checkout order bump matches the specific product the discount was configured for. This allows unauthenticat...
CVE-2026-79630: Authorization Bypass Through User-Controlled Key
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
PT-2026-85414
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
CVE-2026-81288
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...
CVE-2026-81288 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...
CVE-2026-81288
CVE-2026-81288 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the Upsell Order Bump Offer for WooCommerce WordPress plugin, affecting versions 3.1.5 and below . The CVSS v3.1 score is 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L , indicating a network-based attack...
CVE-2026-81288 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...