The Payconiq WordPress plugin versions up to 1.0.4 contain a vulnerability that allows unauthenticated users to access order confirmation links without verifying authorization. This flaw exposes paid order keys and, for recent guest orders, reveals customers' personal information.
The UniPAY Payment Gateway For WooCommerce WordPress plugin up to version 2.3 contains an authentication flaw where payment notifications are not properly verified. The signature verification uses a merchant secret that is empty by default, enabling unauthenticated attackers to forge payment notifications and mark arbitrary orders as paid.
The Product Designer for WooCommerce WordPress | Lumise plugin up to version 2.1.2 contains a directory traversal vulnerability in the process_checkout function. This flaw allows unauthenticated attackers to read arbitrary files on the server by exploiting the lumise_security nonce, which can be obtained without authentication. This vulnerability can expose sensitive information stored on the server.
The Customer Email Verification for WooCommerce plugin for WordPress contains an authentication bypass vulnerability in all versions up to 2.8.2. The flaw arises from a predictable email-verification token and lack of proper capability or nonce checks in the authentication function. This allows unauthenticated attackers to log in as verified WooCommerce customers or mark existing accounts as verified, bypassing email verification controls. Exploitation depends on the presence of a specific database schema column from older plugin versions.
Multiple fraudulent websites impersonating legitimate Korean companies such as Doosan Robotics and Cheonjeong have been discovered. These sites use authentic corporate branding and offer features like invitation-code registration, VIP memberships, and cryptocurrency deposit/withdrawal functions. They instruct victims to make USDT payments via TRON wallet addresses and submit transaction screenshots. Analysis identified TRON wallets with significant transaction volumes, including one with approximately 13 million USDT received. Infrastructure tracking linked these domains to the ValleyRAT malware command and control IP address, but no direct operational connection between ValleyRAT malware and the fraudulent websites or wallets has been confirmed.
Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 and highly prolific by 2025 with over 1,000 victims. It uses a flexible platform enabling affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure, including ESXi hosts. Initial access is commonly gained via phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools. The group employs a double-extortion model, encrypting data and threatening to publish stolen information on their blog and WikiLeaksV2 platform. Notable incidents include the 2024 Synnovis attack impacting UK healthcare services. Qilin is linked to other threat groups and has spawned derivative operations, some maintaining affiliate status while operating independent leak sites.
Multiple vulnerabilities have been identified in the Yamaha wireless LAN router NWR100. Specific details about the nature of these vulnerabilities, their impact, and affected versions are not provided in the available information.
The installer for Yamaha LAN Monitor for Windows may insecurely load Dynamic Link Libraries (DLLs), which can lead to potential security risks during installation.
Yamaha YMS-VPN8 and YMS-VPN8-CP products register Windows services using unquoted file paths. This configuration can lead to potential security risks on Windows systems.
CVE-2026-115522 is a vulnerability in Google Agent Development Kit (ADK) for Python that allows an application to access or modify artifacts belonging to another application when both share a FileArtifactService root directory and the same user_id. This occurs because the service omitted the application name when constructing on-disk paths, leading to improper resource isolation. The issue affects versions 1.19.0 through before 1.39.1 and 2.0.0a1 through before 2.7.0. The vulnerability was fixed by enforcing full per-application path scoping in versions 1.39.1 and 2.7.0.
CVE-2026-104384 is a high-severity vulnerability in EagleCloud Aquila on on-premises platforms up to version 2.6.7.2. It involves insufficient protection of credentials in the tunnel gateway and provisioning interfaces, allowing unauthenticated remote attackers to escalate privileges and access sensitive keys and secrets.
CVE-2026-104383 is a critical code injection vulnerability in the Pigeon MFA service of EagleCloud Aquila on-premises versions up to 2.6.7.2. Authenticated remote attackers can exploit improper control of code generation to execute arbitrary code on affected systems.
A vulnerability in the Linux kernel's p54 wifi firmware parser allows reading beyond record boundaries due to insufficient validation of firmware record lengths. This flaw could cause the parser to read past the intended data fields when processing malformed firmware records. The issue has been addressed by validating component ID and version record lengths and rejecting descriptor values that cause underflow or empty ranges.
CVE-2026-118276 is a medium severity vulnerability in the a2ui-project a2ui software up to version 0.10.6. It affects the formatString function in the Parser component, causing resource consumption when exploited remotely. Public exploit code is available. A patch identified by commit 1f71d1aac1b145ef57c7526f9e0cff316f5934e2 is recommended to fix the issue.
The Appointment Booking Calendar WordPress plugin up to version 1.4.05 contains a stored cross-site scripting (XSS) vulnerability via the 'vs_text_submitbtn' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts if assigned as calendar owners by an administrator. Without such assignment, exploitation requires editor-level access or above.
The Rank Math SEO plugin for WordPress contains a PHP Object Injection vulnerability via deserialization of untrusted input in the updateMeta REST API endpoint. This affects all versions up to and including 1.0.276. Authenticated users with Contributor-level access or higher can exploit this to inject PHP objects. The vulnerability can be chained with a POP gadget chain to achieve remote code execution by writing a webshell to the uploads directory.
The Animated Text Block plugin for WordPress (versions up to 1.2.6) contains a missing authorization vulnerability. Authenticated users with Contributor-level access or higher can exploit this flaw via the 'animated-text' shortcode to read rendered content of any published post, including non-public custom post types that are normally hidden from URLs and the REST API.
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display WordPress plugin is vulnerable to arbitrary file upload in all versions up to and including 3.9.2. The vulnerability arises from insufficient validation of file types in the upload_image function, allowing authenticated users with contributor-level access or higher to upload potentially executable files. Exploitation requires the 'import product image' option to be enabled, which triggers the image download process on product post save. This flaw can lead to remote code execution.
Tabularis versions before 0.28.0 have an SQL injection vulnerability in the SQLite driver. This flaw allows MCP clients to execute stacked SQL statements by manipulating the table_name parameter in the describe_table tool. Exploitation can bypass read-only mode and write approval, enabling attackers to read, modify, or delete SQLite data. The vulnerability carries a high severity rating with a CVSS score of 7.8.
mews/pos versions up to 2.0.0 have a vulnerability due to insufficient verification of data authenticity. This flaw allows unauthenticated attackers to forge payment results by submitting unverified callbacks. Specifically, the GarantiPos, PayForPos, and InterPos 3D Pay and 3D Host handlers do not perform the check3DHash() verification, enabling attackers to tamper with status, amount, or order ID fields and complete orders without payment.
