php-app-race-condition

Vulnerable PHP App Race Condition Environment setup: docker-compose up Environment verification: Connection Test: http://localhost/test.php Vulnerable endpoint: http://localhost/poc.php Race condition exploit: echo http://localhost | nuclei -t race.yml Observe that less than 1280$ were accounted...

CVE-2026-121291

A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates...

CVE-2026-121291 Security Advisory 0222

A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates...

PT-2026-144642

A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates...

CVE-2026-107776 Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount...

EUVD-2026-117401

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount...

CVE-2026-107776

The Dokan WordPress plugin before version 5.3.3 contains a logic flaw where it fails to reconcile the amount credited to a vendor's reverse-withdrawal ledger against the actual amount collected for a payment order. This allows a vendor to clear their outstanding commission debt while paying less ...

Binance hit by largest-ever crypto theft, with $6.3 billion stolen

.kadence-column4826169de20c-07 .kt-inside-inner-colpadding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;.kadence-column4826169de20c-07 .kt-inside-inner-colcolumn-gap:var--global-kb-gap-sm, 1rem;.kadence-column4826169de20c-07...

Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen

Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far. Tether and Circle said they have frozen mo...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self recovery When a node withdraws and it turns out that it is the only node with the filesystem mounted, gfs2 currently tries to replay the local journal to restore the filesystem to a consistent state. This is no...

EUVD-2022-54499

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

WordPress Wallet System for WooCommerce plugin < 2.8.0 - Subscriber+ Forged Wallet Withdrawal Request vulnerability

Subscriber+ Forged Wallet Withdrawal Request vulnerability discovered by Mytears in WordPress Plugin Wallet System for WooCommerce versions 2.8.0...

CVE-2026-94246

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount a...

EUVD-2026-94752

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount a...

CVE-2026-94246 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount a...

CVE-2026-94246 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount a...

CVE-2026-94246

The Wallet System for WooCommerce WordPress plugin, versions before 2.8.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify that the wallet account specified in a withdrawal submission belongs to the authenticated user. This allows any authenticat...

CVE-2026-94246: Authorization Bypass Through User-Controlled Key

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount a...

PT-2026-107848

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount a...

Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M

The attacker who stole about $388 million from the cryptocurrency exchange Bitget gained access through a vulnerability in a third-party security product the exchange used, Bitget said on Monday. The attacker exploited the flaw to obtain high-level internal credentials and then, on September 24,...