CVE-2026-2592

The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'ReturnfromZarinPalGateway' failing to validate that the authority token provided in...

CVE-2026-2592

The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'ReturnfromZarinPalGateway' failing to validate that the authority token provided in...

CVE-2026-2592 Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update

The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'ReturnfromZarinPalGateway' failing to validate that the authority token provided in...

CVE-2026-2592

The CVE concerns the Zarinpal Gateway for WooCommerce plugin for WordPress, affecting all versions up to 5.0.16. The issue is Improper Access Control to Payment Status Update caused by the payment callback handler (Return_from_ZarinPal_Gateway) not validating that the authority token in the callb...

CVE-2026-2592 Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update

The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'ReturnfromZarinPalGateway' failing to validate that the authority token provided in...

PT-2026-20960

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 Description The skills.status function could reveal sensitive information to clients with operator.read access. This occurred because the function returned raw resolved config values within configChecks for...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when using an OCSP responder. OCSP response verification and freshness checks can be bypassed, allowing certificate revocation to be bypassed. Remediation Upgrade org.apache.tomcat:tomcat-coyote-ffm to version...

CVE-2026-2563

A vulnerability was identified in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. Affected is the function setstcreenendeabledstatus/getstatus of the file /f/service/controlDevice of the component jdcapprpc. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the...

WordPress BlueSnap Payment Gateway for WooCommerce plugin <= 3.3.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation vulnerability

Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin BlueSnap Payment Gateway for WooCommerce versions = 3.3.0...

CVE-2026-2564

creationtimestamp| type| source ---|---|--- 2026-02-15 19:28:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116076294415630420 2026-02-16 22:34:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mez4bayevy2n 2026-02-16 22:35:11+00:00| seen|...

CVE-2026-1932

The Appointment Booking Calendar Plugin – Bookr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update-appointment REST API endpoint in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers t...

[SECURITY] Fedora 42 Update: nginx-mod-vts-0.2.4-6.fc42

Nginx virtual host traffic status module...

[SECURITY] Fedora 43 Update: nginx-mod-vts-0.2.4-6.fc43

Nginx virtual host traffic status module...

CVE-2026-25120

creationtimestamp| type| source ---|---|--- 2026-02-14 21:23:41+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-jj5m-h57j-5gv7 2026-02-16 17:30:48+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116081495116754230...

CVE-2026-23184

creationtimestamp| type| source ---|---|--- 2026-02-14 18:02:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116070295502235332...

CVE-2026-23193

creationtimestamp| type| source ---|---|--- 2026-02-14 17:22:17+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116070136666621864 2026-03-13 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0291/ 2026-03-16 03:00:00+00:00| seen|...

UBUNTU-CVE-2026-23180

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for ifid in IRQ handler The IRQ handler extracts ifid from the upper 16 bits of the hardware status register and uses it to index into ethsw-ports without validation. Since ifid can be any 16-bit...

CVE-2026-23122

creationtimestamp| type| source ---|---|--- 2026-02-14 17:08:37+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116070083178332550...

CVE-2025-71221 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: Fix race condition in mmppdmaresidue Add proper locking in mmppdmaresidue to prevent use-after-free when accessing descriptor list and descriptor contents. The race occurs when multiple threads call txstatus...

CVE-2025-71221

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: Fix race condition in mmppdmaresidue Add proper locking in mmppdmaresidue to prevent use-after-free when accessing descriptor list and descriptor contents. The race occurs when multiple threads call txstatus...