CVE-2026-62026 WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3...

SUSE-SU-2026:24126-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...

Security Bulletin: UPDATED security alert for multiple OpenSSL vulnerabilities impacting AIX. Updated On: Fri Oct 9 03:18:49 CDT 2026. Reason: Updated the iFix to include the previously missing OpenSSL 1.1 and 1.0.2 shared libraries.

Summary Vulnerabilities in OpenSSL could cause excessive memory consumption CVE-2026-54874, heap buffer overflow CVE-2026-63072, indefinite cache growth leading to denial of service CVE-2026-63074, invalid pointer dereference CVE-2026-63076, and authentication forgery CVE-2026-75803. OpenSSL is...

SUSE-SU-2026:24134-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...

CVE-2026-103329 Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

WordPress Super Payments plugin < 1.43.1 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Super Payments versions 1.43.1...

CVE-2026-103329

The Super Payments WordPress plugin (versions prior to 1.43.1 ) is vulnerable to an unauthenticated payment confirmation forgery . The flaw exists because the plugin fails to properly verify incoming payment webhook notifications, as the signing key used for signature validation is empty by defau...

BIT-GRAFANA-2026-13720 Editor can forge file-provisioning provenance on dashboards via the dashboard API

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

BIT-GHOST-2026-103285 Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery

Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when...

EUVD-2026-95611

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

EUVD-2026-95311

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...

PT-2026-109148

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...

CVE-2026-107831

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...

NPM: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

NPM: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery vulnerability discovered by ? in WordPress Npm fast-jwt versions 6.2.4...

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

Summary fast-jwt 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and...

GHSA-G3JJ-5CMM-3HXX fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

Summary fast-jwt 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and...

CVE-2026-107724

The fast-jwt library (version 6.2.4 ) contains a vulnerability where raw serialized public JWK or JWKS JSON can be incorrectly classified as an HMAC secret . The root cause is located in src/crypto.js within the performDetectPublicKeyAlgorithms function, which treats non-PEM strings as symmetric ...

CVE-2026-107724 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

EUVD-2026-95312

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

CVE-2026-107724 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...