CVE-2025-15565

The Nexi XPay plugin for WordPress (all versions up to and including 8.3.0) is vulnerable to unauthorized data modification due to missing authorization checks on the redirect function. This allows unauthenticated attackers to mark pending WooCommerce orders as paid or completed. CVSS 3.1 base sc...

CVE-2025-15565 Nexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification

The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions up to, and including, 8.3.0. This makes it possible for unauthenticated attackers to mark pending WooCommerce orders as paid/completed...

CVE-2025-15565

The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions up to, and including, 8.3.0. This makes it possible for unauthenticated attackers to mark pending WooCommerce orders as paid/completed...

CVE-2025-15565 Nexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification

The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions up to, and including, 8.3.0. This makes it possible for unauthenticated attackers to mark pending WooCommerce orders as paid/completed...

CVE-2026-40683

In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the userenabledinvert configuration option is False the default. The ldaprestomodel method in the UserApi class only performed string-to-boolean conversion when...

CVE-2026-34629

creationtimestamp| type| source ---|---|--- 2026-04-14 18:21:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhypoe3v227 2026-04-14 20:17:19+00:00| seen| Telegram/l9bSu4t-Z8RXv5R9-n5DGKDhjKFYmQA28Cy4bVCP0NEotQk 2026-04-14 20:17:42+00:00| seen|...

GHSA-3W8Q-XQ97-5J7X

creationtimestamp| type| source ---|---|--- 2026-04-14 17:27:49+00:00| seen| Telegram/X69Hoh64i7djUBejuAQijXCf66JncuFnYRKez2YtZF33U...

CVE-2025-54510

creationtimestamp| type| source ---|---|--- 2026-04-14 17:15:16+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116404185501428756 2026-04-14 19:20:06+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mji3ydnc3s2z 2026-07-25 15:00:07+00:00| seen|...

CVE-2026-27926

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:09:50+00:00| seen| Telegram/MPYOvuhYuxNHKnSdBgBqerES9cQfATPjIXRx710jNy8Fd40 2026-04-15 06:53:38+00:00| seen|...

CVE-2026-32156

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 18:22:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116404450410856336 2026-04-14 20:13:06+00:00| seen|...

CVE-2026-20930

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 17:28:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116404238027819761 2026-04-14 20:03:36+00:00|...

CVE-2025-67484

creationtimestamp| type| source ---|---|--- 2026-04-14 15:16:42+00:00| seen| Telegram/r8zsFd86IdjBnjQsnpVbmSTohShaGtmjBjBqVT1IiFRWlNI...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow in the profiling.sampling module of asyncio introspection capabilities feature when a privileged process connects to a malicious process via the remote debugging tool. An attacker can read and write memory...

io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files

A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response...

CVE-2026-32188

creationtimestamp| type| source ---|---|--- 2026-04-14 12:20:56+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0116 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:14:46+00:00| seen|...

CGA-28GR-Q28X-4J89

Bulletin has no description...

CVE-2026-32201

creationtimestamp| type| source ---|---|--- 2026-04-14 11:51:20+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-april-2026-monthly-rollup-av26-352 2026-04-14 12:20:56+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0116 2026-04-14 15:49:19+00:00|...

GHSA-3959-6V5Q-45Q2

creationtimestamp| type| source ---|---|--- 2026-04-14 05:17:42+00:00| seen| Telegram/EXit4BCARRaTXD4SBLqO-yd3UPNB5jBijYowsPR2aTE5HY...

GHSA-VC46-VW85-3WVM

creationtimestamp| type| source ---|---|--- 2026-04-14 05:17:42+00:00| seen| Telegram/EXit4BCARRaTXD4SBLqO-yd3UPNB5jBijYowsPR2aTE5HY...

CVE-2026-34225

creationtimestamp| type| source ---|---|--- 2026-04-14 04:27:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjgk53kevx2g 2026-07-07 18:35:02+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jgx9-jr5x-mvpv...