CVE-2026-93510

The Points and Rewards for WooCommerce WordPress plugin (versions before 2.10.4 ) is vulnerable to an arbitrary points and wallet balance manipulation. The root cause is a failure to validate the claimed reward amount or restrict access to the Win Wheel claim handler . Consequently, authenticated...

EUVD-2026-85061

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-77765 Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation

The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item...

CVE-2026-77765

The Better Payment WordPress plugin, versions prior to 2.3.4 , is vulnerable to an Unauthenticated Payment Amount Manipulation vulnerability. The root cause is a failure to validate submitted payment amounts server-side against the merchant's configured fixed price before constructing the gateway...

WordPress Better Payment plugin < 2.3.4 - Unauthenticated Payment Amount Manipulation vulnerability

Unauthenticated Payment Amount Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More versions 2.3.4...

CVE-2026-77765 Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation

The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item...

CVE-2026-12816

A flaw was found in Bouncy Castle for Java. This vulnerability allows for Message Authentication Code MAC forgery in the IESEngine stream-mode. The issue arises from a length-dependent Key Derivation Function KDF split, which an attacker could exploit to bypass integrity checks. This could lead t...

RAMP: Reversing Adversarial Perturbations to Strengthen Clean-Label Backdoor Attacks against Malware Detectors

Deep learning-based malware detectors are commonly updated by fine-tuning on newly collected samples, but this practical update pipeline also creates an attack surface for training-time backdoor attacks. In realistic crowdsourced data collection, however, strict label vetting typically restricts...

CVE-2026-42801: NULL Pointer Dereference

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux asrrc module allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c...

CVE-2026-80444: URL Redirection to Untrusted Site

URL redirection to untrusted site 'open redirect' vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351...

PT-2026-97552

Name of the Vulnerable Software and Affected Versions sfturing hosp order versions up to 627f426331da8086ce8fff2017d65b1ddef384f8 Description A remote manipulation of the getProperties function within the ssm pro/src/main/java/cn/sfturing/utils/MailUtil.java file leads to the cleartext transmissi...

PT-2026-97539

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description An issue exists in the Elasticsearch indexer component where the serializedDataForUpdateAccounts function in indexer/common.go fails to escape the acc.Name variable when constructing bulk JSON and...

PT-2026-97295

Name of the Vulnerable Software and Affected Versions AVESİS versions 202608201331 through 202608240351 Description An open redirect issue exists in Abis Technology Ltd. Co. AVESİS, which allows for input data manipulation by redirecting users to untrusted sites. Recommendations Update AVESİS to...

ROS-20260923-73-0009

The vulnerability of the EXPORTSYMBOLGPL function in the net/netfilter/nfnetlink.osf.c module of the netfilter kernel of the Linux operating system is related to pointer manipulation. Exploitation of this vulnerability could allow a remote attacker to cause a service failure...

ROS-20260923-73-0073

The vulnerability of the niwrite inode function in the fs/ntfs3/frecord.c file of the NTFS file system in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-19179: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression...

"What I See Is What I Hear": Deepfake Detection across Diverse Hearing Abilities

The proliferation of audiovisual deepfakes has lowered the cost of fraud, impersonation, and misinformation, but their success ultimately depends on human perception. Detection requires integrating auditory and visual cues, yet security and privacy research has largely overlooked d/Deaf and...

CVE-2026-77912

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-8849

Use After Free vulnerability in RTI Connext Professional Security Plugins allows File Manipulation. This issue affects Connext Professional: from 7.6.0 before 7.7.0.1...

CVE-2026-43643

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...