DRUPAL-CONTRIB-2026-124

This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability...

AZL-99297 CVE-2026-78689 affecting package nginx for versions less than 1.30.4-1

Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...

CVE-2026-78689

Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...

CVE-2026-83533

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

EUVD-2026-70056

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

CVE-2026-82955

In the unreleased development version of Eclipse aeriOS , the KrakenD instance within the API Gateway component had the disable_jwk_security parameter hard-coded to true with no Helm chart override. This disabled TLS certificate verification when KrakenD fetched the JWKS used for bearer token val...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

EUVD-2026-70046

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-83533

WP Express Checkout WordPress plugin before 2.4.9 contains an unauthenticated payment bypass in the wpec_process_payment handler. The plugin does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

SUSE CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

153M+ driver’s licenses for sale on new dark web platform

A new dark web platform called Nexus claimed to be selling 153 million driver’s license scans and millions of other identity and medical cards. The collection included more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards, including...

CURL-CVE-2026-80230 OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

CVE-2026-16742

A flaw was found in systemd-homed. A local, logged-in user can exploit a missing signature verification in the authentication path when processing home records. This vulnerability allows the user to add arbitrary system groups to their account, which can lead to local privilege escalation and...