CVE-2026-82211

The Nexi XPay Build WordPress plugin through version 7.6.2 is vulnerable to unauthenticated payment completion and order key disclosure. The root cause is a failure to verify the payment result supplied to several unauthenticated routes. This allows an attacker to mark arbitrary orders as paid or...

CVE-2026-103378

The Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0-3.1.0 ) contains a vulnerability where it fails to restrict unauthenticated access to a log file stored in a web-accessible directory. The plugin writes the site's carrier integration key into this file during unauthenticated req...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

GHSA-238X-W2J9-GWWR Payload vulnerable to API key disclosure through ordinary document reads

Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables useAPIKey. - Users have read access to other user documents...

Payload vulnerable to API key disclosure through ordinary document reads

Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables useAPIKey. - Users have read access to other user documents...

NPM: Payload vulnerable to API key disclosure through ordinary document reads

NPM: Payload vulnerable to API key disclosure through ordinary document reads vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-105849

The Payload headless content management system is vulnerable to API key disclosure in versions 3.0.0 to 3.90.0 and canary versions before 4.0.0-canary.34 . If an authentication collection has useAPIKey enabled, users with ordinary read access to other authentication documents can obtain active AP...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: lib/crypto: chacha – The permutedstate variable is zeroed before it leaves the scope of the function. Since the ChaCha permutation is invertible, the local variable permutedstate is sufficient to compute the original state, and...

CVE-2026-71883

In Bouncy Castle for Java LTS before version 2.73.13 , one-shot native packet ciphers (AES-CBC, CCM, CFB, CTR, GCM, and GCM-SIV) suffer from a memory management flaw. The native code uses JNI's ReleaseByteArrayElements in mode 0, which commits native copies back into Java arrays. If an applicatio...

CVE-2026-63573

Observable discrepancy in the CMS RSA PKCS1 v1.5 key-transport unwrap KeyTransRecipientInformation.UnwrapKey in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an...

CVE-2026-97317 Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured...

CVE-2026-97317 Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured...

WordPress Giveaways and Contests by RafflePress plugin < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure vulnerability

Unauthenticated reCAPTCHA Secret Key Disclosure vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Giveaways and Contests by RafflePress versions 1.12.27...

CVE-2026-103098

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

CVE-2026-96173 Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Order Key Disclosure vulnerability

Unauthenticated Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payments for Hubtel versions 1.0.2...