CVE-2026-91020

The WebToffee Gift Cards for WooCommerce WordPress plugin (versions before 1.3.1 ) is vulnerable to an unauthenticated gift card amount manipulation (CWE-472). The root cause is a lack of server-side validation for the user-supplied wt_credit_amount parameter. An attacker can submit an arbitrary ...

CVE-2026-81740 Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

WordPress Paytm Payment Gateway plugin < 2.8.9 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Artus KG in WordPress Plugin Paytm Payment Gateway versions 2.8.9...

CVE-2026-81740 Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

Defense-In-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms

Large Language Models LLMs increasingly support Uncrewed Aerial Vehicle UAV swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without...

Tenable Nessus < 10.12.5 Multiple Vulnerabilities (TNS-2026-26)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.12.5. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-26 advisory. - Nessus did not sufficiently verify the integrity of certain downloaded content...

CVE-2026-51899

In SuperAGI v0.0.14 and prior, controller endpoints /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/editschedule, /api/agents/stopschedule allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different...

CVE-2026-101104: Missing Authorization

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...

CVE-2026-91020: External Control of Assumed-Immutable Web Parameter

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the...

PT-2026-104113

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the...

PT-2026-104432

Name of the Vulnerable Software and Affected Versions LangGraph Python SDK versions 0.1.45 through 0.4.3 Description Resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the actions argument and register the selected handler for every action on...

CVE-2026-102370

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot...

CVE-2026-102370 Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot...

CVE-2021-22873-EXPLOIT

CVE-2021-22873 - Revive Adserver Open Redirect Vulnerability Revive Adserver before version 5.1.0 is vulnerable to open redirects via the dest, oadest, and/or ct0 parameters of the lg.php and ck.php delivery scripts. Originally, this functionality was designed to allow third-party ad servers to...

CVE-2021-42013-EXPLOIT

🚨 CVE-2021-42013 - Apache 2.4.49 & 2.4.50 Remote Code Execution 🚨 CVE-2021-42013 builds upon the previously identified vulnerability, CVE-2021-41773. Despite the Apache team's efforts to address CVE-2021-41773 in version 2.4.50, subsequent investigations revealed that the fix fell short of fully...

EUVD-2026-90749

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

CVE-2026-103245 n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

CVE-2026-103245 n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

CVE-2026-82825

Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. Thi...

EUVD-2026-90494

Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. Thi...