PULSEUnderground Intel

EN VIVO22señales / 24h

FEED

ransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomlamashtu reclama a Vins Viallet · FR · Retail & E-Commerceransomemperador reclama a Phoenix S&S GmbH · DE · Manufacturingransomemperador reclama a Frommann Energie GmbH · DE · Energy & Utilitiesransomqilin reclama a SLTN Inter Access · NL · Not Foundransomkrybit reclama a www.choicegoodwill.com · US · Retail & E-Commerceransomkrybit reclama a mainplace.com.my · MY · Retail & E-Commerceransomkrybit reclama a MODON Developments S.A.E · EG · Manufacturingransomkrybit reclama a www.zhservices.com · Professional Servicesransomkrybit reclama a grupoeuro.com.mx · MX · Manufacturingransomkrybit reclama a www.optika.ca · CA · Technologyransomn0n reclama a Texcar Inc. · Manufacturingransomn0n reclama a GPIC Projectos Con Instalacoes Lda · PT · Manufacturingransomn0n reclama a Asisken Asistencia Médica S.A. · AR · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomlamashtu reclama a Vins Viallet · FR · Retail & E-Commerceransomemperador reclama a Phoenix S&S GmbH · DE · Manufacturingransomemperador reclama a Frommann Energie GmbH · DE · Energy & Utilitiesransomqilin reclama a SLTN Inter Access · NL · Not Foundransomkrybit reclama a www.choicegoodwill.com · US · Retail & E-Commerceransomkrybit reclama a mainplace.com.my · MY · Retail & E-Commerceransomkrybit reclama a MODON Developments S.A.E · EG · Manufacturingransomkrybit reclama a www.zhservices.com · Professional Servicesransomkrybit reclama a grupoeuro.com.mx · MX · Manufacturingransomkrybit reclama a www.optika.ca · CA · Technologyransomn0n reclama a Texcar Inc. · Manufacturingransomn0n reclama a GPIC Projectos Con Instalacoes Lda · PT · Manufacturingransomn0n reclama a Asisken Asistencia Médica S.A. · AR · Healthcare

← Todos los CVEs

CVE Watch24 oct 2026

CVE-2026-114191

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Explo

CVSS

7.5

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 24 oct 2026 · Última mod.: 24 oct 2026 · CWE-862

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.

Referencias oficiales

patchstack.comhttps://patchstack.com/database/wordpress/plugin/upi-qr-code-payment-for-woocommerce/vulnerability/wordpress-upi-qr-code-payment-gateway-for-woocommerce-plugin-1-6-3-broken-access-control-vulnerability?_s_id=cve

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1159725.3 MED

———A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.5h CVE-2026-1141926.5 MED

———Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.8h CVE-2026-1160084.3 MED

——0DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.11h CVE-2026-1147056.5 MED

——0Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.8h CVE-2026-1159757.1 ALT

——0Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects15h CVE-2026-1108926.5 MED

——0Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.8h