CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

PT-2026-66468

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...

PT-2026-66412

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside...

CVE-2026-8497

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate...

CVE-2026-8497

CVE-2026-8497 describes an issue in Devolutions Password Manager (versions up to 2026.2.1.0) where Devolutions Server connection handling performs improper certificate validation on Android, iOS, and macOS. This allows an adjacent-network attacker to intercept and modify sensitive information thr...

CVE-2026-8497

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate...

EUVD-2026-50422

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate...

EUVD-2026-50362

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

EUVD-2026-50275

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...

CVE-2026-65883

CVE-2026-65883 affects Joomla extensions: aimy-extensions.com ’s Captcha-Less Form Guard versions 18.0–20.0 . The issue is a PHP object injection in a forged clfgd field, leading to remote code execution . The root cause and impact are described as RCE with high severity. No explicit exploit deta...

CVE-2026-65883

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...

CVE-2026-9720

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcradminpagehtml function. This makes it possible for...

CVE-2026-59243 Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

PT-2026-65860

Name of the Vulnerable Software and Affected Versions Devolutions Password Manager versions prior to 2026.2.1.1 Description Improper certificate validation in the Devolutions Server connection handling allows an adjacent-network attacker to intercept and modify sensitive information by using a...

PT-2026-65798

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

Rockwell Automation CompactLogix Improper Validation of Integrity Check Value (CVE-2025-11694)

A security issue exists within the affected CompactLogix 5370 controllers due to missing validation of sequence numbers and source IP addresses in the CIP protocol. An attacker can abuse the exposed Connection IDs visible on the controller's web interface to send forged CIP packets, resulting in ...

CVE-2026-57511 SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...