CVE-2026-83537: Insufficient Verification of Data Authenticity

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

PT-2026-88922

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

AutoTrans: AI-Assisted Automatic Translation of Security Assertions for RISC-V Processors

Reusing a set of verified security assertions across RISC-V processor targets remains one of the most expensive bottlenecks in hardware security verification. Manual translation takes hours per assertion. Raw LLM translation is fast but unreliable, introducing signal hallucination, where the mode...

PT-2026-88863

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it...

PT-2026-88840

Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...

CVE-2026-21106: Improper Verification of Intent by Broadcast Receiver

Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...

CVE-2026-79970: Improper Verification of Cryptographic Signature

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to...

VulnCheck KEV: CVE-2026-14359

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21793-1)

"The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21793-1 advisory. Changes in hauler: - update to 2.1.0 bsc1265425, CVE-2026-41888: v2.1.0 is a minor release built on the containerd- native foundation laid down...

CVE-2026-71809

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

PT-2026-88880

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-87732: Improper Verification of Cryptographic Signature

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...

ROS-20260909-73-0032

The vulnerability in Chromium is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker who operates remotely to gain unauthorized access to protected information...

ROS-20260909-73-0070

The vulnerability in Chromium is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker who operates remotely to gain unauthorized access to protected information...

CVE-2023-54355: Improper Verification of Cryptographic Signature

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

CVE-2026-8615: Missing Authorization

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

Security Advisory 0182

Security Advisory 0182 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-86109 CVSSv3.1 Base Score: 6.6...

CVE-2026-56207: Improper Verification of Cryptographic Signature

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

Microsoft Copilot Studio Graphical Tool Privilege Escalation

The vulnerability of Microsoft Copilot Studio’s graphical tool for creating and supporting artificial intelligence is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to gain increased privileges...

openSUSE 16: libsystemd0 / libudev1 / systemd / systemd-boot / systemd-container / etc (openSUSE-SU-2026:21754-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21754-1 advisory. This update for systemd fixes the following issue: Security issue fixed: - CVE-2026-16742: systemd-homed: local privilege escalation due to...