254 matches found
CVE-2026-68136
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...
CVE-2026-17012 Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_email
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...
EUVD-2026-54400
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...
CVE-2026-15211
Technical details about CVE-2026-15211 are not publicly available in the provided documents; monitor for updates.
CVE-2026-15211 Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...
EUVD-2026-54190
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...
CVE-2026-15152
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...
CLSA-2026-1784769550 TuxCare security update for marked (3 CVEs)
TuxCare rebuilt marked to address 3 CVEs. Fixed in 1.2.7-tuxcare.1...
CLSA-2026-1784769549 TuxCare security update for marked (4 CVEs)
TuxCare rebuilt marked to address 4 CVEs. Fixed in 0.8.2-tuxcare.1...
CLSA-2026-1784769543 TuxCare security update for marked (4 CVEs)
TuxCare rebuilt marked to address 4 CVEs. Fixed in 0.3.19-tuxcare.1...
CLSA-2026-1777077481 TuxCare security update for marked (1 CVE)
TuxCare rebuilt marked to address 1 CVE. Fixed in 4.0.6-tuxcare.1...
CLSA-2026-1773188128 TuxCare security update for marked (9 CVEs)
TuxCare rebuilt marked to address 9 CVEs. Fixed in 0.2.10-tuxcare.1...
CLSA-2026-1770941372 TuxCare security update for marked (1 CVE)
TuxCare rebuilt marked to address 1 CVE. Fixed in 4.0.7-tuxcare.1...
CLSA-2026-1771978225 TuxCare security update for marked (2 CVEs)
TuxCare rebuilt marked to address 2 CVEs. Fixed in 0.7.0-tuxcare.1...
CLSA-2026-1771200578 TuxCare security update for marked (2 CVEs)
TuxCare rebuilt marked to address 2 CVEs. Fixed in 4.0.9-tuxcare.1...
CLSA-2026-1770682160 TuxCare security update for marked (1 CVE)
TuxCare rebuilt marked to address 1 CVE. Fixed in 4.0.8-tuxcare.1...
marked-sanitizer (0.0.0) potentially affected by unknown CVE via ammonia (3.1.4)
ammonia CARGO version 3.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on ammonia and may be impacted: - marked-sanitizer 0.0.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0213...
PT-2026-61473
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs and afs components where write operations for directories and links could be skipped due to lock contention and the use of WB SYNC NONE. This occurs within t...