267936 matches found
CVE-2026-103311: Insufficient Verification of Data Authenticity
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...
ALSA-2026:84744 Important: gimp:2.8 security update
The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: gimp:...
PT-2026-133059
TuxCare rebuilt @babel/plugin-transform-for-of to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
PT-2026-133163
TuxCare rebuilt @babel/plugin-transform-block-scoping to address 2 CVEs. Fixed in 7.23.0-tuxcare.1...
PT-2026-133146
TuxCare rebuilt @babel/plugin-transform-react-jsx-source to address 1 CVE. Fixed in 7.29.0-tuxcare.2...
PT-2026-133061
TuxCare rebuilt @babel/plugin-transform-for-of to address 1 CVE. Fixed in 7.21.0-tuxcare.4...
PT-2026-132510
TuxCare rebuilt @babel/plugin-transform-typescript to address 1 CVE. Fixed in 7.18.9-tuxcare.2...
PT-2026-133089
TuxCare rebuilt @babel/plugin-transform-regenerator to address 1 CVE. Fixed in 7.21.0-tuxcare.4...
PT-2026-133161
TuxCare rebuilt @babel/plugin-transform-block-scoping to address 1 CVE. Fixed in 7.24.5-tuxcare.2...
PT-2026-133162
TuxCare rebuilt @babel/plugin-transform-block-scoping to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
PT-2026-133157
TuxCare rebuilt @babel/plugin-transform-block-scoping to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...
CVE-2026-112329: Missing Authorization
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...
CVE-2026-112161: Insufficient Verification of Data Authenticity
MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...
CVE-2026-94272: Missing Authorization
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...
CVE-2026-74921: Improper Neutralization of Input During Web Page Generation
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that...
Malicious code in animatecss-tailwind-graphic (npm)
animatecss-tailwind-graphic 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by jamesvectorpack on 2026-09-28. src/motion.js:5 requires the private scoped...
PT-2026-132511
TuxCare rebuilt @babel/plugin-transform-typescript to address 1 CVE. Fixed in 7.29.0-tuxcare.1...
PT-2026-117240
Name of the Vulnerable Software and Affected Versions Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin versions prior to 1.4.2 Description The plugin fails to verify the authenticity of incoming payment webhook notifications. This occurs because the shared secret used to validat...