CVE-2026-103324

The Cardinity Payment Gateway for WooCommerce WordPress plugin versions prior to 3.4.2 is vulnerable to unauthenticated payment notification forgery. The root cause is that the plugin does not properly verify the authenticity of received notifications because the signing secret is empty by defaul...

CVE-2026-81499

Summary The network address set API is missing from the auth object project-expansion switch, so a project-restricted client can read and rewrite the default project's address sets. Details Project confinement bypass on the network address set API All six handlers in...

CVE-2020-15120

In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's...