CVE-2026-62436 grant-table: version change racing with other operations

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

CVE-2026-62435

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

CVE-2026-62435 grant-table: version change racing with other operations

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

CVE-2026-62436 grant-table: version change racing with other operations

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

CVE-2026-62436

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

CVE-2026-15411

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perfor...

CVE-2026-41874

CVE-2026-41874 affects Quick.Cart; hard-coded, plaintext admin credentials stored in a configuration file allow local access to credentials when an attacker can access the server filesystem, potentially enabling privilege escalation. Only version 6.7 was tested; all versions are considered vulner...

grant-table: version change racing with other operations

ISSUE DESCRIPTION With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, as a bigger shared entry structure is then needed while the shared table doesn't change size. Switching from ...

CVE-2026-15411

The CVE-2026-15411 entry describes a vulnerability in StoreGrowth: Smart Sales Booster for WooCommerce (WordPress). Affected component: BoGo/Popup AJAX flow, specifically the create_popup AJAX action. Root cause: the plugin does not properly verify authorization, and the ajd_protected nonce used ...

CVE-2026-15411

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perfor...

CVE-2026-13440

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'messagepopup' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and...

EUVD-2026-49760

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbotsendemailtranscriptfree. This makes it possible for unauthenticated attackers to exfiltrate full chat...

CVE-2026-65880

Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type...

WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy PayPal Buy Now Button versions = 2.0.4...

EUVD-2026-49751

Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type...

CVE-2026-14785

The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-59248

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

EUVD-2026-49739

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

SUSE-SU-2026:22959-1 Security update for python313, python3

This update for python313, python3 fixes the following issues: Changes in python313: Update to 3.13.14: - Security - gh-151159: Bumps the OpenSSL version to 3.0.21 on Android. - gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack in the ML-KEM Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines. An attacker can recover a long-term private key by sending ciphertexts and measuring the time taken by repeated decapsulation operations th...