CVE-2026-89634

creationtimestamp| type| source ---|---|--- 2026-09-13 09:50:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvfcz3rfgd2j...

CVE-2026-75800 Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

Summary A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not explicitly cross-check whether the incomi...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5 through 0.9.3) fails to verify the authenticity of incoming payment notification webhooks before acting on them. An unauthenticated attacker who knows a store's merchant identifier can mark arbitrary orders as paid , or can...

CVE-2026-89094

creationtimestamp| type| source ---|---|--- 2026-09-10 21:42:16+00:00| seen| https://infosec.exchange/users/cR0w/statuses/117248919367381106 2026-09-10 22:08:35+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv72urrr3j2t 2026-09-10 22:20:07+00:00| seen|...

CVE-2026-16660

creationtimestamp| type| source ---|---|--- 2026-09-10 11:20:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv5wn45new2g 2026-09-10 11:20:07+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117246473202940990...

EUVD-2026-75392

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

PT-2026-89350

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

CVE-2026-78486

creationtimestamp| type| source ---|---|--- 2026-09-09 14:00:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6szc6tdupyg6j...

CVE-2026-76202

creationtimestamp| type| source ---|---|--- 2026-09-09 11:49:09+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv3hs62yqe2t 2026-09-13 16:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvfzqtnhay2j...

CVE-2026-78574

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

EUVD-2026-74175

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

CVE-2026-84386

A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via...

CVE-2026-84386

A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via...

EUVD-2026-72921

A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via...

CVE-2026-84386

CVE-2026-84386 is an unverified ownership vulnerability in Fortinet FortiClient for Windows , affecting versions 7.4.0 through 7.4.7 and all versions of the 7.2 line. The flaw may allow an attacker to bypass access control , resulting in low integrity and high availability impact. The CVSS 3.1 sc...

CVE-2026-86600

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-73314

creationtimestamp| type| source ---|---|--- 2026-09-08 15:06:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gdjs4b2wvs3ob 2026-09-15 00:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvjdegeyaj2y...

CVE-2026-62654

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This...