JLSEC-2026-1152

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured wildcard deny rule but was not a subset...

JLSEC-2026-1148

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupti...

JLSEC-2026-1151

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny...

CVE-2026-15931 Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes...

CVE-2026-15931 Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes...

CVE-2026-15931

The Simple Membership WordPress plugin, in versions before 4.7.8 , is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin fails to sanitise a subscriber name value received from an unauthenticated payment approval request and fails to escape it when rendered in the admin...

Authorization Bypass

@better-auth/stripe is vulnerable to Authorization Bypass. The vulnerability is due to inconsistent organization ID validation between the middleware and request handler, allowing authenticated users to perform unauthorized subscription actions and access billing information for other organizatio...

CVE-2026-67975: Improper Access Control

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TOLAB add/remove subscription commands...

PT-2026-67540

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO LAB add/remove subscription commands...

CVE-2026-67975

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TOLAB add/remove subscription commands...

CVE-2026-67974: Improper Input Validation

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

PT-2026-67539

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

CVE-2026-67975

NASA cFS v7.0.1 is affected by an incorrect access control vulnerability. This flaw allows an attacker to arbitrarily remove low-index subscriptions and add new streams by sending TO_LAB add/remove subscription commands. Exploitation details and specific remediation steps are not provided in the ...

CVE-2026-67974

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

CVE-2026-67974

A parser boundary flaw exists in the Software Bus Network (SBN) application's peer subscription message handling within NASA cFS v7.0.1 . This vulnerability allows an attacker to trigger a Denial of Service (DoS) by sending a crafted packet . No specific remediation instructions or exploit links ...

CVE-2026-67974

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

CVE-2026-14920 AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

Summary...

CVE-2026-14920 AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

Summary...

CVE-2026-14920

Summary...

CVE-2026-67329

@better-auth/stripe versions = 1.4.11 and = 1.7.0-beta.0 and 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the...