CVE-2026-105850 Payload: Order confirmation validation issue in Payload Ecommerce

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass

CVE-2026-6060 – 通过地址验证绕过实现的 QUIC 握手放大 程序代码（Python 模拟） quicserversim.py - Vulnerable QUIC server simulated handshake import socket def sendquicinitialconn, addr, serversalt: Respond with a large "server hello" without validating source address In real QUIC, the server must echo the client's token;...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-20230-Scanner

CVE-2026-20230 Scanner CVE-2026-20230 の影響を受ける可能性がある Cisco Unified Communications Manager Unified CM のデプロイを識別するための Python ベースのスキャナおよび検証ツール。 機能 Cisco Unified CM インスタンスを検出 WebDialer の公開状態を確認 単一ターゲットおよびバルクスキャンをサポート オプションの PoC 検証機能を含む シンプルなコマンドラインインターフェース 使用方法 python3 scanner.py...

NPM: i18next-http-backend incomplete URL validation permits SSRF

NPM: i18next-http-backend incomplete URL validation permits SSRF vulnerability discovered by ? in WordPress Npm i18next-http-backend versions 4.0.2...

GHSA-XVQ9-WJP8-HWQF i18next-http-backend incomplete URL validation permits SSRF

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolat...

cve-2026-75650-magento-validation-lab

CVE-2026-75650 / VULN-39341 Docker validation lab This standalone lab reproduces the complete unauthenticated StyleSmuggler HTTP chain on a revision-pinned Magento Open Source 2.4.9 checkout. It then applies Adobe's VULN-39341 patch and proves that the identical request sequence no longer reaches...

CVE-2026-67270

Dell Container Storage Modules CSM versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend...

EUVD-2026-93458

Dell Container Storage Modules CSM versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend...

CVE-2026-67270

Dell Container Storage Modules (CSM) versions prior to 1.18.0 are affected by an Improper Certificate Validation vulnerability within the proxy-server component. An unauthenticated attacker located on an adjacent network could exploit this flaw to cause information exposure of storage backend adm...

CVE-2026-34498

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: Optimole WordPress 플러그인의 CSRF로 인한 임의 파일 덮어쓰기 요약 Optimole WordPress 플러그인버전 = 4.2.5에서 발견된 CSRFCross-Site Request Forgery 취약점으로 인해, 인증되지 않은 공격자가 nonce 검증 부재로 인해 wpajaxoptmlreplacefile AJAX 액션을 통해 기존 미디어 라이브러리 자산을 무단으로 덮어쓸 수 있습니다. CVE ID : CVE-2026-11784 취약점 유형 : CSRF Cross-Site Reque...

CVE-2026-105794

MsQuic , a cross-platform C implementation of the IETF QUIC protocol, contains an improper certificate validation vulnerability (CWE-295) in versions prior to 2.4.20, 2.5.11, and 2.6.1 . When using the OpenSSL or QuicTLS TLS backends, the software fails to verify that a server certificate matches...

CVE-2026-105794 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...

CVE-2026-105794 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...

llm-council-vapt

LLM Council — VAPT 취약점 발견 검증 클라이언트에게 전달되기 전에 침투 테스트 결과취약점 발견를 검증하는 블라인드 피어 리뷰 파이프라인입니다. 독립적인 전문가 관점렌즈이 결과를 평가하고, 서로 블라인드 리뷰를 수행하며, 의장Chairman이 하나의 검증된 평결을 종합합니다. 보고할 가치가 있는지, 심각도가 적절히 조정되었는지 여부를 판단합니다. 두 가지 실행 방식: 모드| 위치| 설명 ---|---|--- 수동 의장 Manual Chairman| claude.ai / Claude 앱 채팅| 각 렌즈를 개별적으로...