GHSA-7VVP-J573-5584 Shopware: Unauthenticated data extraction possible through store-api.order endpoint

Summary An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. Details Data Exposure Depending on the order payload configuration, attackers may retrieve: -...

Sextortion “I recorded you” emails reuse passwords found in disposable inboxes

Our malware removal support team recently flagged a new wave of sextortion emails, with the subject line: “You pervert, I recorded you!” If the message sounds familiar, that's because it's a variation of the long-running "Hello pervert" scam. The email claims the target’s device has been infected...

Microsoft Payment Orchestrator Service Access Control Error Vulnerability

Microsoft Payment Orchestrator Service is a Microsoft feature that provides cloud-native payment process automation and orchestration for the financial services industry. An Access Control Error vulnerability exists in Microsoft Payment Orchestrator Service, which stems from improper authenticati...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in facilitator payment processing on Solana. An attacker can interfere with or manipulate payment transactions by exploiting a race condition. Remediation Upgrade...

Improper Authentication

Overview @x402/svm is a x402 Payment Protocol SVM Implementation Affected versions of this package are vulnerable to Improper Authentication in facilitator payment processing on Solana. An attacker can interfere with or manipulate payment transactions by exploiting a race condition. Remediation...

CVE-2026-26125

Payment Orchestrator Service Elevation of Privilege Vulnerability...

EUVD-2026-9890

Payment Orchestrator Service Elevation of Privilege Vulnerability...

CVE-2026-26125

Payment Orchestrator Service Elevation of Privilege Vulnerability...

CVE-2026-26125

CVE-2026-26125 describes an elevation of privilege vulnerability affecting the Payment Orchestrator Service. The PT-2026-23573 entry confirms a privilege-escalation issue with Payment Orchestrator Service but does not specify affected versions. Multiple sources label this as a Microsoft product i...

CVE-2026-26125 Payment Orchestrator Service Elevation of Privilege Vulnerability

...

CVE-2026-26125 Payment Orchestrator Service Elevation of Privilege Vulnerability

...

CVE-2026-26125

Payment Orchestrator Service Elevation of Privilege Vulnerability...

Payment Orchestrator Service Elevation of Privilege Vulnerability

...

Microsoft Payment Orchestrator Service 访问控制错误漏洞

Microsoft Payment Orchestrator Service is a Microsoft feature that provides cloud-native payment process automation and orchestration for the financial services industry. An Access Control Error vulnerability exists in Microsoft Payment Orchestrator Service, which stems from improper authenticati...

PT-2026-23573

Name of the Vulnerable Software and Affected Versions Payment Orchestrator Service affected versions not specified Description A service elevation of privilege issue exists in the Payment Orchestrator Service. The vulnerability allows for privilege escalation. Recommendations At the moment, there...

KLA90914 PE vulnerability in Microsoft Payment Orchestrator Service

An elevation of privilege vulnerability was found in Microsoft Payment Orchestrator Service. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-26125 Exploitation CVE list CVE-2026-26125 critical KB list Solution Install necessary updates from the KB...

CVE-2026-25146

OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are at least two paths where the gatewayapikey secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary...

CVE-2026-25146 OpenEMR's payments gateway_api_key secret rendered into client JS code

OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are at least two paths where the gatewayapikey secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary...

CVE-2026-25146 OpenEMR's payments gateway_api_key secret rendered into client JS code

OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are at least two paths where the gatewayapikey secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary...

EUVD-2026-9329

OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are at least two paths where the gatewayapikey secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary...