WP Stripe Checkout versions before 1.2.2.62 do not verify Stripe webhook signatures when no signing secret is configured, which is the default setting. This improper authentication allows unauthenticated attackers to forge payment completion notifications and create completed orders without actual payment.
A Cross-Site Scripting (XSS) vulnerability exists in the Contact Form by Supsystic WordPress plugin versions before 1.8.0. The plugin fails to properly sanitize and escape the form name, allowing users with form editor access to inject arbitrary scripts. On multisite WordPress installations, this vulnerability can be exploited to cross privilege boundaries when administrators lack the unfiltered_html capability.
The Chikkili- Google Pay India for Woocommerce WordPress plugin up to version 1.0.6 contains a missing authorization vulnerability. It fails to verify that payment notifications originate from the legitimate payment provider before marking orders as paid. This flaw allows unauthenticated attackers to mark arbitrary orders as paid without making any actual payment.
CVE-2026-116044 is a medium severity vulnerability in prasathmani TinyFileManager up to version 2.6. It involves an unrestricted file upload issue in the Remote URL File Upload Module within tinyfilemanager.php. This vulnerability allows remote attackers to upload files without restrictions. The exploit has been publicly disclosed, but there is no indication of active exploitation in the wild. The vendor has not responded to the disclosure, and no patch or official fix is currently available.
The URL https://pastebin.com/raw/QGrjKCsR was observed in the wild as part of attacker activity on 2026-10-25. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation purposes. The activity was detected by OffSeq Mirage honeypot sensors and originated from attacker infrastructure in Great Britain. There are no known exploits actively using this URL, and no specific affected software versions have been identified.
A vulnerability in YunaiV/zhijiantianya ruoyi-vue-pro up to version 2026.09 affects the SMS Code Verification component, specifically the SmsCodeServiceImpl.validateSmsCode0 function. This flaw allows improper restriction of excessive authentication attempts, potentially enabling attackers to bypass rate limiting on SMS code validation. The attack requires high complexity and no privileges, with no user interaction needed. Exploit code has been published, but exploitation is considered difficult. The vendor has not responded to the disclosure. The CVSS score is 3.7, indicating low severity.
A vulnerability in YunaiV/zhijiantianya ruoyi-vue-pro up to version 2026.09 affects the SMS Code Verification component in the AuthController.java file. Improper handling of the mobile/code arguments leads to improper authentication, allowing remote attackers to exploit this flaw. The vulnerability has a CVSS score of 7.3, indicating a medium severity. The vendor has not responded to disclosure requests, and no patch or remediation guidance is currently available. Public exploit code exists but there are no confirmed reports of exploitation in the wild.
CVE-2026-85228 is an integer overflow vulnerability in the tensor buffer validation component of the Deep Java Library. The vulnerability could potentially lead to incorrect validation of tensor buffer sizes. No affected versions or detailed technical information are provided. There is no information about available patches or exploits in the wild.
CVE-2026-87911 is a reported vulnerability with minimal publicly available information. No technical details, affected versions, or patch information have been provided. There is no evidence of exploitation in the wild at this time.
CVE-2026-87912 and CVE-2026-87913 refer to missing S3 bucket ownership verification vulnerabilities in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server. The vulnerabilities relate to improper validation of S3 bucket ownership, which could potentially lead to security issues. No specific affected versions or detailed technical information are provided. No known exploits are reported in the wild. No patch or remediation information is available at this time.
CVE-2026-84942 is a stored cross-site scripting (XSS) vulnerability in OpenSearch Dashboards involving a bypass of the Vega expression function. The vulnerability allows malicious input to be stored and later executed in users' browsers. No affected versions or patch information are provided. There is no evidence of exploitation in the wild.
CVE-2026-85788 is identified as a vulnerability related to the awslabs mysql-mcp-server. No detailed technical information, affected versions, or patch status is provided in the available data.
CVE-2026-111943 is a key-generation flaw in the external certificate authority eMudhra/emSign that made intermediate CA private keys recoverable. Three root certificates—AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3—were included in AWS trust bundles. This exposure allows soft-fail TLS clients to be vulnerable to man-in-the-middle attacks. AWS is actively removing these affected roots from their trust bundles. Customers using CloudFront custom origins or Application Load Balancer OIDC/JWT authentication should verify if their certificates chain to any of the affected roots and reissue certificates from a different CA before enforcement occurs.
CVE-2026-116004 is a cross-site scripting (XSS) vulnerability in the onyx-dot-app Onyx product, specifically affecting version 5.0.0. The vulnerability exists in an unknown function within the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The flaw allows remote attackers to execute XSS attacks. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix. The CVSS 4.0 score rates this as a medium severity issue.
A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
The npm package 'tailwind-base-buttons' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as full control of the computer may have been given to an attacker.
The noelc-css-blender npm package contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by this package.
The npm package tailwindcss-theme-kit contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.