CVE-2026-66444

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-66431

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

CVE-2026-66461

CVE-2026-66461 is a vulnerability in the WordPress SMEPay: UPI Gateway for WooCommerce plugin (versions

CVE-2026-66461 WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce = 1.0.5 versions...

CVE-2026-66461 WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce = 1.0.5 versions...

CVE-2026-66444

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-66444

Affected software: WordPress Payment Forms for Paystack plugin

EUVD-2026-57869

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-66444 WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-66444 WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-66431

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

CVE-2026-66431

CVE-2026-66431 concerns the WordPress plugin WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) with versions up to 1.0.7. The issue is Unauthenticated Broken Access Control, meaning an attacker can access restricted functionality without authentication. The description and c...

EUVD-2026-57864

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

CVE-2026-66431 WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

CVE-2026-73488

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...

WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud

A previously unseen Android near field communication NFC relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan RAT called SpyNote as part of a contactless payment fraud scheme. The purpose-built malware, according to Group-IB, is designed to...

New Android malware lets criminals use your bank card in real time

Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it "WindRelay." NFC Near Field Communication is wireless technology that allows devices such as smartphones, payment cards,...

CVE-2026-73488 Flowise before 3.1.3 IDOR via customer-default-source endpoint

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...

EUVD-2026-57804

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...

CVE-2026-73488 Flowise before 3.1.3 IDOR via customer-default-source endpoint

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...