CVE-2026-87974

The Asaas Gateway for WooCommerce WordPress plugin (versions before 2.7.8 ) is vulnerable to an unauthenticated order payment bypass via a webhook flaw. The plugin fails to properly authenticate its payment webhook by accepting an empty access token in its default configuration. Furthermore, it d...

GHSA-HVR9-72V2-FFF3 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

Summary SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension --...