CVE-2026-66692

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-65559

Shop manager Privilege Escalation in Order Delivery Date for WooCommerce = 4.6.0 versions...

CVE-2026-65504

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

EUVD-2026-53900

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66692 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66692

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66692

CVE-2026-66692 affects the WordPress Colissimo Officiel: Méthodes de livraison pour WooCommerce plugin (≤ 2.10.0). The issue is an insecure direct object reference (IDOR) in delivery methods. According to the available sources, the vulnerability is rated CVSS 3.1 base score 4.3 (Network, Privileg...

EUVD-2026-53984

Shop manager Privilege Escalation in Order Delivery Date for WooCommerce = 4.6.0 versions...

CVE-2026-65559 WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability

Shop manager Privilege Escalation in Order Delivery Date for WooCommerce = 4.6.0 versions...

CVE-2026-65559

The CVE relates to a privilege-escalation issue in the WordPress plugin Order Delivery Date for WooCommerce, affecting versions up to 4.6.0. The vulnerability targets the shop manager role within the plugin’s delivery date functionality. The provided data constrain the impact to a privilege escal...

CVE-2026-65504

CVE-2026-65504 describes an unauthenticated broken access control in the WordPress BOX NOW Delivery Croatia plugin, vulnerable in versions

EUVD-2026-53962

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-8400

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

CVE-2026-8400

CVE-2026-8400 affects IBM WebSphere Application Server 8.5, 9.0, and WebSphere Application Server Liberty Continuous Delivery. The issue is in the ORB component of IBM SDK, Java Technology Edition, where a malicious IIOP server could cause loading and instantiation of arbitrary classes, enabling ...

Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

MAL-2026-13278 Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...

MAL-2026-13284 Malicious code in dolyame-boxy-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via...

Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...

Malicious code in bigops-telephony-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b10fc5eff860f82de5bc03b910dbe2b96b06d54c22741cbb593b007dd9ee38 On require of the package, shim.js downloads a platform-specific executable over HTTPS from string-concatenated hostnames...

Malicious code in bnpl-blocks-atom-bnpl-image-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893348e540e6c6a6cb856324bb2379d838bead9f4d2ceab1ae7c3509094871f6 On require of the package, index.js loads compat.js, which reconstructs C2 hostnames from string-split arrays e.g.,...