CVE-2026-16565

The CVE-2026-16565 affects the Dokan AI Powered WooCommerce Multivendor Marketplace Solution for WordPress, specifically the plugin before version 5.0.9. The root cause is that the product-attribute REST write endpoints do not verify product ownership, allowing a Dokan vendor to modify the attrib...

CVE-2026-16564

The CVE-2026-16564 entry concerns the Dokan plugin (WordPress) prior to 5.0.9. The REST endpoint that handles bulk order-status changes does not verify order ownership, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace, including orders be...

CVE-2026-16565 Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...

CVE-2026-14557 SoftMarket <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass

The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID...

EUVD-2026-52171

The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID...

CVE-2026-14557

The CVE concerns the SoftMarket — Digital Marketplace WordPress plugin (through version 1.0.0). Root cause: the authentication token is not properly validated in one branch of the email-verification flow. Impact: unauthenticated attackers can obtain a valid session as any verified user by supplyi...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path compute...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes comparison offsets as length - hash.length - 2, so its two comparison loops jointly...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-ext-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk16 is a Bouncy Castle Crypto package that is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.6. Affected versions of this package are vulnerable to Improper...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes comparison offsets as length - hash.length - 2, so its two comparison loops jointly...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk15 is a package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5. Affected versions of this package are vulnerable to Improper Verification of...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-ext-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path compute...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes comparison offsets as length - hash.length - 2, so its two comparison loops jointly...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...