cve-2026-47777

CVE-2026-47777 — Mastodon Featured Collections 授权绕过 概述 我负责任地披露了一个影响 Mastodon 实验性 Featured Collections 联邦管道的高危授权绕过 漏洞。 CVE ID： CVE-2026-47777 受影响组件 ActivityPub::VerifyFeaturedItemService 弱点 CWE-345 — 数据真实性验证不足 CWE-863 — 授权不正确 CVSS v3.1 分数| 向量 ---|--- 7.5（高危）|...

CVE-2024-9106

CVE-2024-9106 Wechat Social login = 1.3.0 - 認証バイパス 説明: WordPress用Wechat Social...

ROS-20260921-73-0110

The vulnerability of the GPO group policy management component of the Samba software is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow an attacker, operating remotely, to circumvent existing security restrictions...

CVE-2026-62874

Azure Billing is affected by an elevation of privilege vulnerability caused by insufficient verification of data authenticity , allowing an unauthorized attacker to elevate privileges over a network with no prior access or user interaction. The vulnerability is rated CRITICAL (CVSS 3.1: 10.0) wit...

The vulnerability of the io_poll_get_ownership() function in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the iopollgetownership function in the Linux operating system’s kernel is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow an attacker to trigger a service failure...

CVE-2026-54176

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits...

CVE-2026-86809

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...

CVE-2026-80172

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions contain an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated remote attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens , since there is no nonce valida...

EUVD-2026-74853

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-14296

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

CVE-2026-82813

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

CVE-2026-82813

CVE-2026-82813 affects TubeBuddy for YouTube Extension (BEN Group) up to version 5.8.4 on Chrome. The vulnerability resides in the TBGlobal.GetToken function within the file tubebuddymaster1.js , where insufficient verification of data authenticity occurs when the argument t/c/r is manipulated. A...

CVE-2026-82813 BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

EUVD-2026-68680

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

CVE-2026-78417

Devolutions Remote Desktop Manager versions 2026.2.17.0 and earlier, and 2026.1.24.0 and earlier, contain a vulnerability in the IronVNC client due to insufficient verification of data authenticity . During RSA-AES authentication , the client automatically accepts the server's RSA key without pro...

CVE-2026-78417

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

ROS-20260824-73-0019

Vulnerability of .NET software platforms and the Microsoft .NET Framework is related to insufficient verification of data authenticity. Exploitation of this vulnerability can allow attackers operating remotely to bypass existing security mechanisms...

ROS-20260824-73-0020

Vulnerability of .NET software platforms and the Microsoft .NET Framework is related to insufficient verification of data authenticity. Exploitation of this vulnerability can allow attackers operating remotely to bypass existing security mechanisms...

Kibana 9.4.x < 9.4.4 Privilege Escalation (ESA-2026-83)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-83 advisory. - Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature...

EEF-CVE-2026-53425 Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses

Summary Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validateauthresp/3 in lib/samly/sphandler.ex validates a SAML response for the...