CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-56727

The open-source helpdesk system Zammad is vulnerable to PGP signature spoofing prior to version 7.0.2 . The root cause is that the system silently discards the return value of the gpg verification call during inbound PGP email processing. Consequently, the handler unconditionally writes a success...

BIT-NEXTCLOUD-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

PT-2026-98941

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description In the inbound PGP email processing, the return value of the gpg verification call is silently discarded. The handler unconditionally marks the security preferences of the article as having a successf...

Remote Desktop client for Windows Desktop (September 2026)

The Remote Desktop client for Windows Desktop installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper control of generation of code 'code injection' in Remote Desktop Client allows an unauthorized attacker to execute code ove...

PT-2026-98999

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

CVE-2026-56727: Improper Authentication

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

Improper Verification of Cryptographic Signature

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the authcomplete method in the VKAppOAuth2 backend, where the authkey signature is not required to be...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a signature verification bypass vulnerability in joserfc (CVE-2026-49852)

Summary An authentication and signature verification bypass vulnerability in the joserfc JSON Object Signing and Encryption JOSE library CVE-2026-49852 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.6.8. Vulnerability Details...

WordPress Premium Packages plugin 7.0.0-7.2.0 - Unauthenticated PayPal Webhook Signature Verification Bypass vulnerability

Unauthenticated PayPal Webhook Signature Verification Bypass vulnerability discovered by Farid Narimanov in WordPress Plugin WPDM – Premium Packages versions 7.0.0-7.2.0...

CVE-2026-82407

The Klever-Go blockchain implementation (prior to version 1.7.20 ) contains a vulnerability where the Register function and runtime validator update path in core/kapp/validators/validators.go accept BLSPublicKey values without performing curve, prime-order subgroup, or nonzero validation. Because...

SUSE CVE-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

EUVD-2026-85194

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

CVE-2026-93511 Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id the...

EUVD-2026-85063

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id the...

CVE-2026-93511

The Premium Packages WordPress plugin (versions 7.0.0-7.2.0 ) is vulnerable to an unauthenticated PayPal webhook signature verification bypass . Because the plugin fails to verify PayPal's webhook signature before processing notifications, an attacker can forge payment confirmations and subscript...

CVE-2026-93511 Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id the...

EUVD-2026-85049

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...