Denial-Of-Service (DoS)

Http4s is vulnerable to a denial-of-service DoS. The vulnerability is due to an inverted stale-nonce comparison that prevents fresh nonces from being removed, which allows an unauthenticated attacker to repeatedly trigger authentication challenges and cause the persistent nonce map to grow until...

Security update for perl-Authen-SASL

This update for perl-Authen-SASL fixes the following issue: CVE-2026-86219: replayed authentication responses accepted due to unverified nonce in serverstep bsc1279806. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2026:4280-1 Security update for perl-Authen-SASL

This update for perl-Authen-SASL fixes the following issue: - CVE-2026-86219: replayed authentication responses accepted due to unverified nonce in serverstep bsc1279806...

PT-2026-96668

Name of the Vulnerable Software and Affected Versions ThumbPress versions prior to 6.2.2 Description Authenticated users with Subscriber-level access and above can deactivate the plugin by sending a crafted POST request to the 'admin-ajax' endpoint. This occurs because the send deactivation surve...

CVE-2026-15890

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

CVE-2026-15890 AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

CVE-2026-15890 AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

CVE-2026-15890

CVE-2026-15890 affects the Zephyr RTOS PSA Internal Trusted Storage (ITS) transform module. The default AEAD nonce provider (secure_storage_its_transform_aead_get_nonce) stores its nonce counter in unsynchronized function-local static variables. Two concurrent threads writing the same entry UID c...

EUVD-2026-84178

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

CVE-2026-15890 AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

CVE-2026-86802

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

CVE-2026-15890: Reusing a Nonce, Key Pair in Encryption

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

PT-2026-96272

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description An issue exists in the PSA Internal Trusted Storage ITS transform module where the function secure storage its transform aead get nonce uses unsynchronized function-local static variables s...

PT-2026-96059

Name of the Vulnerable Software and Affected Versions To Do List Member WordPress plugin versions prior to 1.7 Description An import routine lacks authorization and nonce checks, and fails to validate the source location of fetched data. This allows unauthenticated users to create arbitrary...

OESA-2026-4004 perl-Authen-SASL security update

Authen::SASL::Perl is the pure Perl implementation of SASL mechanisms in the Authen::SASL framework, At the time of this writing it provides the client part implementation for the following SASL mechanisms. Security Fixes: Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept...

CVE-2026-92410 Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-92410 Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-92410

The Sign-up Sheets WordPress plugin, in versions before 2.4.0 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is the insufficient validation of the CSRF nonce protecting the sign-up deletion action. An attacker can exploit this by sending a forged request to delete s...

EUVD-2026-83674

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-11899

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...