PT-2026-97184

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description The plugin fails to perform a nonce, capability, or ownership check before executing a one-time payment-field migration during the construction of an admin screen. This...

PT-2026-97158

Name of the Vulnerable Software and Affected Versions zportals WordPress plugin versions prior to 6.4.2 Description The plugin fails to perform capability or nonce checks on several AJAX actions. This allows users with subscriber-level accounts to modify stored integration settings. A nonce is a...

PT-2026-97197

Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions prior to 4.1.11 Description Insufficient access restrictions and missing nonce verification for a post-cloning action allow users with Contributor-level permissions or higher to duplicate arbitrary...

SUSE SLES12 Security Update : perl-Authen-SASL (SUSE-SU-2026:4280-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4280-1 advisory. This update for perl-Authen-SASL fixes the following issue: - CVE-2026-86219: replayed authentication responses accepted due to unverified...

Denial-Of-Service (DoS)

Http4s is vulnerable to a denial-of-service DoS. The vulnerability is due to an inverted stale-nonce comparison that prevents fresh nonces from being removed, which allows an unauthenticated attacker to repeatedly trigger authentication challenges and cause the persistent nonce map to grow until...

Security update for perl-Authen-SASL

This update for perl-Authen-SASL fixes the following issue: CVE-2026-86219: replayed authentication responses accepted due to unverified nonce in serverstep bsc1279806. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2026:4280-1 Security update for perl-Authen-SASL

This update for perl-Authen-SASL fixes the following issue: - CVE-2026-86219: replayed authentication responses accepted due to unverified nonce in serverstep bsc1279806...

PT-2026-96668

Name of the Vulnerable Software and Affected Versions ThumbPress versions prior to 6.2.2 Description Authenticated users with Subscriber-level access and above can deactivate the plugin by sending a crafted POST request to the 'admin-ajax' endpoint. This occurs because the send deactivation surve...

CVE-2026-15890

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

CVE-2026-15890 AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

EUVD-2026-84178

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

CVE-2026-15890 AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

CVE-2026-15890

CVE-2026-15890 affects the Zephyr RTOS PSA Internal Trusted Storage (ITS) transform module. The default AEAD nonce provider (secure_storage_its_transform_aead_get_nonce) stores its nonce counter in unsynchronized function-local static variables. Two concurrent threads writing the same entry UID c...

CVE-2026-15890 AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

CVE-2026-86802

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

PT-2026-96059

Name of the Vulnerable Software and Affected Versions To Do List Member WordPress plugin versions prior to 1.7 Description An import routine lacks authorization and nonce checks, and fails to validate the source location of fetched data. This allows unauthenticated users to create arbitrary...

CVE-2026-15890: Reusing a Nonce, Key Pair in Encryption

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

PT-2026-96272

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description An issue exists in the PSA Internal Trusted Storage ITS transform module where the function secure storage its transform aead get nonce uses unsynchronized function-local static variables s...

OESA-2026-4004 perl-Authen-SASL security update

Authen::SASL::Perl is the pure Perl implementation of SASL mechanisms in the Authen::SASL framework, At the time of this writing it provides the client part implementation for the following SASL mechanisms. Security Fixes: Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept...

CVE-2026-92410 Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...