CVE-2024-11725 SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings function in all versions up to, and including, 3.7.6. This makes it...

CVE-2024-11725

CVE-2024-11725 concerns the SMS Alert Order Notifications – WooCommerce WordPress plugin. Wordfence reports a missing capability check in updateWcWarrantySettings() across all versions up to and including 3.7.6, allowing authenticated attackers with subscriber-level access or higher to modify arb...

CVE-2024-11496

The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infilityglobalajax function in all versions up to, and including, 2.9.8. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

PT-2025-1662 · WordPress · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global plugin for WordPress versions up to, and including, 2.9.8 Description: The issue allows authenticated attackers with Subscriber-level access and above to update plugin options, potentially breaking the site, due to a missing...

SUSE CVE-2024-56826

A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opjdecompress utility. This can lead to an application crash or other undefined behavior...

CVE-2024-56324

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity XXE injection on the GoCD server. Theoretically, the XXE vulnerability can result in...

CVE-2024-56324 GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity XXE injection on the GoCD server. Theoretically, the XXE vulnerability can result in...

CVE-2024-21980

A flaw was found in SNP firmware. This vulnerability allows a malicious hypervisor to overwrite a guest's memory or UMC seed, resulting in loss of confidentiality and integrity via improper restriction of write operations. Mitigation Available mitigation requires to update BIOS for updating...

PT-2025-49793

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists within the kernel’s DRM/XE subsystem, specifically in the xe gem fault function, which can lead to an oops kernel panic during the execution of core hotunplug tests. This...

PT-2025-40348

Name of the Vulnerable Software and Affected Versions Chromium affected versions not specified Description A use-after-free condition exists in V8 when evaluating the compile-time options parameter, which detaches the ArrayBuffer holding the wire bytes. This issue was reported by Google Big Sleep...

PT-2026-2889

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to the handling of ERSPAN traffic in GRE tunnels. Specifically, the options len field within the ip tunnel info structure is not properly...

PT-2026-2884

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.54-syzkaller-00144-g5f0270f1ba00 Description The Linux kernel contains an issue in the ext4 filesystem related to string handling within the parse apply sb mount options function. The strscpy pad function is...

PT-2025-54486

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 7.87.0-150400.7.26.1 openSUSE Leap 15.6 affected versions not specified SUSE Linux Enterprise Server 15 SP4 affected versions not specified Description The issue relates to libcurl's handling of TLS options during...

CVE-2024-56219

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.6.1...

CVE-2024-56219

Missing Authorization vulnerability in MarketingFire Widget Options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through 4.0.6.1...

CVE-2024-56219 WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.6.1...

CVE-2024-56219 WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in MarketingFire Widget Options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through 4.0.6.1...

CVE-2024-56219

The CVE-2024-56219 entry describes a Missing Authorization vulnerability in WordPress Widget Options plugin, affecting versions up to 4.0.6.1. The underlying issue is broken/authentication-guarded access control in the Widget Options configuration, enabling exploitation of insufficient access che...

PT-2024-36753 · Unknown · Marketingfire Widget Options

Name of the Vulnerable Software and Affected Versions: MarketingFire Widget Options versions 4.0.6.1 and earlier Description: The issue is related to a missing authorization vulnerability in MarketingFire Widget Options, which allows exploiting incorrectly configured access control security level...

WordPress plugin Widget Options 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...