WordPress Popup for CF7 with Sweet Alert 1.6.5 Cross Site Request Forgery

WordPress Popup for CF7 with Sweet Alert plugin versions 1.6.5 and below suffer from a cross site request forgery vulnerability. https://packetstorm.news/download/231122...

ROS-20260911-73-0141

The vulnerability of the DeviceBoundSessionCredentials component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain access to confidential data through a specially created HTML...

PT-2026-89837

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

openSUSE 16: libzypp / libzypp-devel / zypper / zypper-aptitude / zypper-log / etc (openSUSE-SU-2026:21808-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21808-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. Non security issues fixed: - Eco...

CVE-2026-86809: Insufficient Verification of Data Authenticity

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...

Ivanti Neurons for ITSM has a missing authorization vulnerability (CNVD-2026-37876)

Ivanti Neurons for ITSM is a modern IT Service Management ITSM software developed by Ivanti Corporation. Ivanti Neurons for ITSM has a missing authorization vulnerability; this vulnerability stems from improper handling of access permission verification. Attackers can exploit this vulnerability t...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

Impact The GitHub Trigger generated a signing secret when it registered a webhook and verified X-Hub-Signature-256 on each delivery. When GitHub answered the create request with a 422 because a webhook for the URL already existed, the node adopted the remote hook but kept only its id and events,...

GHSA-5M98-CGCR-XX3Q n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

Impact The GitHub Trigger generated a signing secret when it registered a webhook and verified X-Hub-Signature-256 on each delivery. When GitHub answered the create request with a 422 because a webhook for the URL already existed, the node adopted the remote hook but kept only its id and events,...

NPM: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

NPM: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

CVE-2026-89043

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-89042

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

CVE-2026-89042 passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

EUVD-2026-75631

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

CVE-2026-87912

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a...

EUVD-2026-75571

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage...

CVE-2026-87913 Missing S3 bucket ownership verification in the AWS Security Agent MCP server

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage...