CVE-2026-103379 WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order...

CVE-2026-103379

The WATI Chat and Notification WordPress plugin, affecting versions through 1.1.8 , is vulnerable to an unauthenticated customer order PII disclosure . The flaw exists because a public endpoint fails to require a valid, non-empty secret when returning a stored API token . An unauthenticated attac...

GitLab: Persistent XSS on public project page

Details A project admin can set up a custom issue tracker integration. This setting misses a check to make sure that it's a real URL and, thus, can use the javascript handler to execute arbitrary Javascript. Browsers use this handler to execute inline Javascript. This can lead to an account take...