2354 matches found
CVE-2026-93510 Points and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...
WordPress Points and Rewards for WooCommerce plugin < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation vulnerability
Subscriber+ Arbitrary Points and Wallet Balance Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin Points and Rewards for WooCommerce versions 2.10.4...
CVE-2026-93510 Points and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...
CVE-2026-93510
The Points and Rewards for WooCommerce WordPress plugin (versions before 2.10.4 ) is vulnerable to an arbitrary points and wallet balance manipulation. The root cause is a failure to validate the claimed reward amount or restrict access to the Win Wheel claim handler . Consequently, authenticated...
EUVD-2026-85062
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...
CVE-2026-93510: Missing Authorization
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...
PT-2026-97199
Name of the Vulnerable Software and Affected Versions Points and Rewards for WooCommerce WordPress plugin versions prior to 2.10.4 Description Authenticated users with Subscriber privileges or higher can credit their own accounts with an unlimited amount of loyalty points. This occurs because the...
EulerOS 2.0 SP10 : python-pip (EulerOS-SA-2026-3716)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...
CVE-2026-54716
Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-hw: A memory leak has been fixed in qcomcpufreqhwreadlut. If qcomcpufreqhwreadlut fails to obtain the operation table, the program will terminate, resulting in the “table” resource not being released...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi: mvm: Fix for 6 GHz scan construction If there are more than 255 colocated APs during 2.4/5 GHz scanning, the 6 GHz scan construction will loop indefinitely. This is because the loop variable is of type u8, which ca...
Astra Linux – Vulnerability in libsodium
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data, mishandles checks for whether an elliptic curve point is valid. This occurs because it sometimes allows points that are not part of the main cryptographic group...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerabilities have been resolved: cifs: Fixed a buffer overflow issue when parsing NFS reparse points. ReparseDataLength is the sum of the InodeType size and the DataBuffer size. To obtain the DataBuffer size, it is necessary to subtract the InodeType size fro...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: BPF: Added schedule points in batch operations. SYZbot reported various soft lockups caused by BPF batch operations. INFO: Task kworker/1:1:27 was blocked for more than 140 seconds. INFO: Task hung during the rcubarrier...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed an issue where the index out of bounds occurred in the DCN30 degamma hardware format translation. This commit addresses a potential index out of bounds issue in the cm3helpertranslatecurvetodegammahwformat...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: Fixed an issue where an index out of bounds could occur in the degamma hardware format translation. This issue was addressed by fixing the index out of bounds situation in the...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: The issue involves fixing a use-after-free condition in lazyopptables after delaying the probe. When the function devpmoppoffindiccpaths in allocateopptable returns -EPROBEDEFER, the opptable is freed again, and it waits until al...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: Venus: pmhelpers: Fixed a warning in the OPP phase during the probe. Fixed the following WARN messages that were triggered during the Venus driver probe in version 5.19.0-rc8-next-20220728: WARNING: CPU: 7 PID: 339 at...
