EUVD-2026-89623

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...

WordPress InPost PL plugin 1.7.5-1.9.7 - Unauthenticated Order Status Forgery vulnerability

Unauthenticated Order Status Forgery vulnerability discovered by ryan fabella in WordPress Plugin InPost PL versions 1.7.5-1.9.7...

CVE-2026-93580 InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...

CVE-2026-93580

The InPost PL WordPress plugin (versions prior to 1.9.8 ) is vulnerable to unauthenticated order status forgery. The root cause is a failure to verify the authenticity of incoming shipment webhook requests; the plugin relies on a non-secret identifier and an unenforced IP check. This allows an un...

CVE-2026-93580: Missing Authorization

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...

VulnCheck KEV: CVE-2023-54402

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value testtoken to bypass authentication. Attackers can exploit the unrestricted URL scheme handlin...

AlmaLinux 9.2 [TuxCare] Security Update: munge / munge-devel / munge-libs (ALMALINUX9.2:CLSA-2026:1772571803)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1772571803 advisory. - MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer...

PT-2026-103471

Name of the Vulnerable Software and Affected Versions Tugtainer versions prior to 1.30.6 Description An authenticated user can trigger the backend server to send outbound HTTP requests to arbitrary user-supplied URLs. This occurs via the '/settings/test notification' endpoint, which accepts a url...

PT-2026-103044

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...

PT-2026-103518

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.9.5 Description A server-side request forgery SSRF issue exists in the canvas.present capability. This flaw allows the bypass of URL risk evaluations typically enforced by canvas.navigate. Attackers...

Telerik UI for ASP.NET AJAX 2010.1.309 < 2026.2.708 Multiple RadAsyncUpload Vulnerabilities

The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2010.1.309 or later and prior to 2026.2.708. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can...

AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2026:1784899428)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784899428 advisory. - NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential...

AlmaLinux 9.2 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc (ALMALINUX9.2:CLSA-2025:1739962899)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739962899 advisory. - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept,...

Linux Distros Unpatched Vulnerability : CVE-2026-102268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize...

CentOS Linux 7 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc (CENTOS7:CLSA-2025:1739387995)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1739387995 advisory. - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept,...

Linux Distros Unpatched Vulnerability : CVE-2026-102271

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because asymmetric-key guard...

Linux Distros Unpatched Vulnerability : CVE-2026-102272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JW...

SUSE CVE-2026-102268

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...

SUSE CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

SUSE CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...