49382 matches found
CVE-2026-15148
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...
CVE-2026-49008
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...
CVE-2026-49008
The CVE-2026-49008 entry concerns the ZTE F689 product and describes an integrity-check credential leakage in an application function. The vulnerability arises from unencrypted information in device firmware that could allow an attacker to obtain credentials related to the integrity verification ...
EUVD-2026-54410
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...
CVE-2026-15148
Technical details are not publicly available in the provided documents. Monitor for updates.
CVE-2026-12261
A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...
CVE-2026-16030
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...
CVE-2026-16038
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services...
EUVD-2026-54386
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services...
EUVD-2026-54385
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...
CVE-2026-16038 MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services...
CVE-2026-16038
Summary : CVE-2026-16038 affects the MStore API WordPress plugin prior to 4.21.0. The vulnerability arises because the plugin does not verify payment with the gateway on several payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order as fully paid and obtain ...
EUVD-2026-54379
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information the subscribed product, status, and dates by...
EUVD-2026-54316
Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-54326
Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54188
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...
CVE-2026-62873
Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-62918
Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network...
Security update for perl-Mojo-JWT (moderate)
openSUSE Security Update: Security update for perl-Mojo-JWT Announcement ID: openSUSE-SU-2026:0279-1 Rating: moderate References: 1271935 Cross-References: CVE-2026-9537 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...