CVE-2026-14562

The teddy-bear-customize-addon WordPress plugin (versions through 1.0.5 ) fails to perform authorization or ownership checks before returning WooCommerce order metadata and customer-uploaded attachment URLs . This allows unauthenticated attackers to disclose other customers' order and attachment ...

CVE-2026-11496

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

CVE-2025-67261

CVE-2025-67261 - Inyección SQL ciega basada en contenido en Abacre Retail Point of Sale 14.0.0.396 Abacre Retail Point of Sale 14.0.0.396 es vulnerable a la inyección SQL ciega basada en contenido. La vulnerabilidad existe en la función Search de la página Orders. La función "Search" de la página...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

CVE-2026-86170

A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the...

MiracleLinux 8 : freerdp-2.11.7-12.el8_10 (AXSA:2026-1756:28)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1756:28 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafte...

CVE-2026-84849

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...

CVE-2026-84849 WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...

EUVD-2026-70597

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...

CVE-2026-84849

CVE-2026-84849 affects the Pre-Orders for WooCommerce WordPress plugin in versions 2.3 and earlier . The vulnerability is an unauthenticated bypass , meaning no prior login is required to exploit it. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicati...

WordPress Pre-Orders for WooCommerce plugin <= 2.3.1 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by MoonFuji in WordPress Plugin Pre-Orders for WooCommerce versions = 2.3.1...

PT-2026-85123

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...

MiracleLinux 9 : freerdp-2.11.7-7.el9_8.6 (AXSA:2026-1752:27)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1752:27 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafte...

EUVD-2026-70046

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

RLSA-2026:61379 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP...

RockyLinux 9 : freerdp (RLSA-2026:61379)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61379 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafted...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...