CVE-2026-105946 is an out-of-bounds read vulnerability in the QAuthenticator NTLM authentication handling within the Qt Network module. It affects applications using QNetworkAccessManager or QTcpSocket that authenticate with NTLM. A malicious server or proxy can send a crafted NTLM challenge to trigger this flaw, potentially exposing sensitive heap memory contents or causing an application crash. The vulnerability affects Qt versions from 6.8.0 up to but not including 6.8.10, and from 6.9.0 up to but not including 6.11.2. Fixed versions are 6.8.10 and 6.11.2. The CVSS 4.0 score is 5.3, indicating medium severity.
The TiendaCrypto para WooCommerce WordPress plugin versions 1.0.1 through 1.2.1 improperly verify payment webhook authenticity by validating the request signature against an always-empty key. This flaw allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.
CVE-2026-103359 is a vulnerability in the PayDunya WooCommerce Payment Gateway WordPress plugin up to version 1.1.6. The plugin fails to verify the authenticity of incoming payment notifications properly. Until the gateway is configured, it uses a value derived from an empty secret for authentication, which can be computed by anyone. This flaw allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed without authorization.
The qs library versions 6.12.0 through 6.16.1 have a vulnerability in the stringify function when used with the allowEmptyArrays option enabled. Keys of empty arrays are not properly encoded, allowing special characters like &, =, and # in keys to be interpreted as query string syntax rather than data. This can lead to injection of additional parameters or truncation of the query string. The issue is fixed in version 6.17.0.
The Kirki plugin for WordPress up to version 6.2.5 contains a vulnerability that allows privilege escalation via PHP object injection. Authenticated users with Subscriber-level access or higher can exploit a missing capability check in the 'get-single-symbol' AJAX dispatcher branch to inject malicious PHP objects. This can lead to overwriting an administrator's password and gaining administrative access.
Psono Server versions 5.3.5 through 7.2.3 contain a vulnerability where a permission class fails to enforce token write scope when claiming a device code. An authenticated attacker with a restricted API key-derived session can claim a device code they control and escalate to a full read-write session valid for up to 365 days. This escalation bypasses the original token's scope and lifetime restrictions but does not bypass two-factor authentication or disclose plaintext secrets.
The Analytics Insights – Google Analytics Dashboard for WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the Page Title field. This vulnerability exists in all versions up to and including 6.3.12. It allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages.
The Payment Integration Wompi WordPress plugin versions up to 4.0.1 does not verify the authenticity of incoming payment notifications by default. This is due to the callback checksum relying on a merchant secret that is empty until manually configured. As a result, an unauthenticated attacker can forge payment notifications and mark arbitrary orders as paid.
The Payex Payment Gateway for Woocommerce WordPress plugin versions up to 1.2.10 contains an authentication flaw. It does not properly verify the authenticity of incoming payment notifications because it relies on a validation secret that is empty by default. This allows unauthenticated attackers to forge payment confirmations and mark any order as paid.
GROWI, a product by GROWI, Inc., has been reported to contain multiple vulnerabilities. No specific details about the nature, impact, or affected versions of these vulnerabilities have been provided.
A vulnerability in Psono Server CE and EE versions 4.0.33 through 7.2.3 allows an authenticated attacker with a write-enabled but read-disabled API key to access encrypted secret data via the bulk-secret-read endpoint when URL_PREFIX is configured. This occurs due to incorrect authorization logic that compares request paths without considering the URL prefix, causing the endpoint to authorize requests with write scope instead of read scope. The default configuration without URL_PREFIX is not affected. The issue is fixed in version 7.2.4.
A Server-Side Request Forgery (SSRF) vulnerability exists in esaqa GmbH Psono Server CE and EE versions 0.1.0 through 7.2.3. The flaw allows an authenticated attacker to specify a host for Duo device configuration, causing the server to connect to that host over HTTPS on port 443 without an allowlist or explicit timeout. The vulnerability enables internal DNS and service reachability probing but requires TLS certificate validation and does not allow arbitrary protocol or port access. Unresponsive targets may also tie up server workers until OS timeouts occur. The issue is fixed in version 7.2.4.
Psono Server CE & EE versions 3.1.0 through 7.2.3 contain an authentication bypass vulnerability due to improper handling of WebAuthn challenges. An attacker with the user's password and a captured valid WebAuthn assertion can replay the assertion multiple times to bypass the WebAuthn second factor. This flaw is fixed in version 7.2.4.
Psono Server versions 1.0.0 through 7.2.3 have a missing authorization vulnerability in file-repository operations. An authenticated user with read-only access can exploit this flaw to upload or overwrite repository objects by abusing the file-transfer credential direction enforcement. This could lead to unauthorized data modification and storage consumption. The issue is fixed in version 7.2.4.