CVE-2026-94260

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting...

CVE-2026-91076

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers...

EUVD-2026-100866

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting...

EUVD-2026-100862

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers...

WordPress Robokassa payment gateway for Woocommerce plugin < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed vulnerability

Unauthenticated Arbitrary Order Status Change to Failed vulnerability discovered by JunHee CHO in WordPress Plugin Robokassa payment gateway for Woocommerce versions 1.9.0...

PT-2026-113695

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

citrix-honeypot

Citrix ADC NetScaler Honeypot Detects and logs payloads for CVE-2019-19781 Shitrix / Citrixmash Logs failed login attempts Serves content and headers taken from real appliance in order to increase chance of indexing on search engines e.g. google, shodan etc. Installation Precompiled Precompiled...

CVE-2021-27188

CVE-2021-27188 Suggested description The FX Aggregator terminal client by "Sovremennye Delovye Tekhnologii" allows attackers to cause a denial of service access suspended for five hours by making five invalid login attempts to a victim's account. VulnerabilityType Other DoS Vendor of Product OOO...

stylesmuggler

StyleSmuggler HTTP PoC Privates Forschungs-Repository für die ausschließlich HTTP-basierte Reproduktion von StyleSmuggler, CVE-2026-75650, gegen ein lokales Magento Open Source Lab. Die vollständige technische Analyse finden Sie in Magento StyleSmuggler RCE: Report Poisoning to Code Execution. De...

CVE-2024-38143

CVE-2024-38143 Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability Successful exploitation can lead to possible escalation to NT AUTHORITY\SYSTEM Background While on a client engagement, I had to test a physical laptop and for some reason, stumbled upon this article by Matthew...

CVE-2026-87841

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state...

CVE-2025-60791

CVE-2025-60791 CVE-2025-60791: Cleartext Storage of Sensitive Information in Memory. Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The...

CVE-2026-75962

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-75962

The Post SMTP WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.1 . The root cause is insufficient input sanitization and output escaping regarding the 'user_email' parameter. Attackers can bypass the plugin's validator by using numeric HT...

EUVD-2026-92961

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: fixed the issue where the free nid was missing in f2fshandlefailedinode. This patch fixes the failure reported in xfstests/generic/475. 293.680694 F2FS-fs dm-1: May lose orphaned inode; run fsck to fix. 293.685358 Buffer...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Turn quotas off if mount fails after enabling quotas Yi discovered during a review of the patch “ext4: Don’t report errors with inconsistent journal features” that when ext4markrecoverycomplete returns an error value, the...

PT-2026-104546

Name of the Vulnerable Software and Affected Versions Mail logging – WP Mail Catcher versions prior to 2.1.13 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs via the PHPMailer wp mail failed...

CVE-2026-103601

Release of unverified plaintext in the CCM CcmBlockCipher and DSTU 7624 CCM KCcmBlockCipher AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets th...