SUSE-SU-2026:23913-1 Security update for perl-Authen-SASL

This update for perl-Authen-SASL fixes the following issue: - CVE-2026-86219: replayed authentication responses accepted due to unverified nonce in serverstep bsc1279806...

CVE-2026-85682 YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-85682 YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-85682

The YOP Poll plugin for WordPress (versions up to and including 7.0.10 ) is vulnerable to an Origin Validation Error . The root cause is the plugin transmitting a wp_rest nonce to window.opener via postMessage() using a wildcard targetOrigin . This allows an unauthenticated attacker to steal a RE...

CVE-2026-88845 MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...

PT-2026-97734

Name of the Vulnerable Software and Affected Versions YOP Poll versions prior to 7.0.11 Description The plugin contains an origin validation error where it transmits a wp rest nonce to window.opener using the postMessage function with a wildcard targetOrigin. This allows unauthenticated attackers...

PT-2026-97713

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An issue exists where the plugin fails to perform capability or nonce checks on an administrative maintenance action. A nonce is a unique token used to protect against...

SUSE SLED15 / SLES15 Security Update : perl-Authen-SASL (SUSE-SU-2026:4302-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4302-1 advisory. This update for perl-Authen-SASL fixes the following issue: - CVE-2026-86219: replayed authentication responses accepte...

Security update for perl-Authen-SASL

This update for perl-Authen-SASL fixes the following issue: CVE-2026-86219: replayed authentication responses accepted due to unverified nonce in serverstep bsc1279806. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2026:4302-1 Security update for perl-Authen-SASL

This update for perl-Authen-SASL fixes the following issue: - CVE-2026-86219: replayed authentication responses accepted due to unverified nonce in serverstep bsc1279806...

CVE-2026-95626 Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...

CVE-2026-95626 Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...

CVE-2026-87069

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any...

CVE-2026-18364

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

CVE-2026-93507

The WC Fields Factory WordPress plugin (versions before 4.1.11 ) is vulnerable to an authorization bypass because it fails to properly restrict access to or verify a nonce for a post-cloning action. This flaw allows users with Contributor-level privileges and above to duplicate arbitrary posts, r...

CVE-2026-87069

The Forminator Forms WordPress plugin (versions 1.38.1-1.57.2.0 ) is vulnerable to an authorization bypass because it fails to perform nonce , capability , or ownership checks during a one-time payment-field migration. This migration occurs during the construction of an admin screen, which is tri...

EUVD-2026-85022

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

CVE-2026-12803

A flaw was found in Bouncy Castle for Java. The cryptographic module responsible for authenticated encryption does not correctly link a unique random value nonce with the message authentication code when no additional authenticated data is provided. This oversight could allow an attacker to forge...

PT-2026-97184

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description The plugin fails to perform a nonce, capability, or ownership check before executing a one-time payment-field migration during the construction of an admin screen. This...

PT-2026-97158

Name of the Vulnerable Software and Affected Versions zportals WordPress plugin versions prior to 6.4.2 Description The plugin fails to perform capability or nonce checks on several AJAX actions. This allows users with subscriber-level accounts to modify stored integration settings. A nonce is a...