Live threat intelligence radar

V-SFT software by FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. has a stack-based buffer overflow vulnerability. This flaw can be triggered by opening a specially crafted V7 file, potentially allowing information disclosure or arbitrary code execution. The vulnerability affects versions from 0 up to and including 6.2.11.0. It has a high severity rating with a CVSS score of 7.8.

The Eurobank WooCommerce Payment Gateway WordPress plugin up to version 2.1.1 has a vulnerability where it does not verify that payment-confirmation requests come from the legitimate payment provider. By default, the plugin ships with an empty secret used for authentication, allowing unauthenticated attackers to mark any pending order as paid or force orders into a failed status without needing any secret.

UNC6240 (ShinyHunters) has resumed a mass exploitation campaign targeting Oracle PeopleSoft systems worldwide by exploiting CVE-2026-35273. The attacker bypassed web application firewall protections using URL encoding to access a vulnerable endpoint. Post-exploitation, multiple web shells, a trojanized backdoor (SIDEEYE), tunneling tools, and persistence agents were deployed. The actor conducted reconnaissance, credential theft, and prepared for data exfiltration, indicating potential extortion activities.

CVE-2026-116223 is a medium-severity vulnerability in icret EasyImage versions 2.8.0 through 2.8.7. It involves improper privilege management due to manipulation of the 'hash' argument in the app/del.php file. This flaw can be exploited remotely without authentication. A patch identified by commit b12cb67d447bcbb67e21c8f011d0f5638229760c has been released to fix the issue. Exploit code is publicly available, increasing the risk of exploitation.

CVE-2026-116124 is a heap-based buffer overflow vulnerability in GNOME libgsf versions 1.14.0 through 1.14.19. The flaw exists in the ole_info_read_metabat function within the OLE2 Parser component, allowing remote attackers to trigger the overflow. This vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. A patch identified by commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a is available to address the issue.

The Mintpay for WooCommerce WordPress plugin up to version 2.2.3 contains an improper access control vulnerability. This flaw allows unauthenticated attackers to manipulate payment callbacks, enabling them to mark arbitrary orders as paid, cancel orders, and access sensitive order details including customer contact information.

The OPay Payment Gateway for WooCommerce WordPress plugin up to version 2.5.5 has an improper authentication vulnerability. The plugin does not properly verify that payment notifications come from the legitimate payment provider because the secret used for signature validation is empty by default. This flaw allows unauthenticated attackers to forge valid notifications and manipulate order statuses, marking orders as paid, cancelled, or failed.

The Online Payments with iK Pay Gateway WordPress plugin before version 3.0.4 contains an authentication flaw that allows unauthenticated attackers to forge payment gateway callbacks. This vulnerability enables attackers to mark arbitrary orders as paid without actual payment or mark unprocessed orders as failed.

The Payment Gateway WordPress plugin up to version 2.2.0 has an authentication flaw where it does not verify that a shared secret is configured before using it to authenticate bank payment-notification callbacks. This allows unauthenticated attackers to forge valid notifications and mark any WooCommerce order as paid if the secret is not set. Additionally, the same callback can be used to move any pending order to a failed state regardless of secret configuration.

The CCAvenue Payment Gateway for WooCommerce plugin up to version 3.1 has an improper access control vulnerability. It fails to verify that payment-confirmation requests originate from the legitimate payment provider. The verification key is derived from a value that is empty by default, allowing unauthenticated attackers to forge payment confirmations and mark orders as paid without actual payment.