WordPress GetPaid plugin < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification vulnerability

Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification vulnerability discovered by Pedro Pinho in WordPress Plugin GetPaid versions 2.8.55...

WordPress Payment Gateway for Redsys & WooCommerce Lite plugin < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback vulnerability

Unauthenticated Payment Confirmation via Unverified Inespay Callback vulnerability discovered by Shivamani Vastrala in WordPress Plugin Redsys for WooCommerce Light versions 7.0.2...

WordPress WP Travel Engine plugin < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification vulnerability

Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Travel Engine versions 6.8.2...

CLSA-2026-1787220376 TuxCare security update for urllib3 (1 CVE)

TuxCare rebuilt urllib3 to address 1 CVE. Fixed in 1.25.11.post7+tuxcare...

Improper Certificate Validation

RabbitMQ Java client library is vulnerable to improper certificate validation. The vulnerability is due to ConnectionFactory.useSslProtocol accepting arbitrary server certificates and disabling hostname verification, which allows a network attacker to intercept TLS connections, impersonate the...

xalgorix v4.5.153

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

CVE-2026-75860

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user...

Comparison of Object References Instead of Object Contents

Overview Affected versions of this package are vulnerable to Comparison of Object References Instead of Object Contents in the process of comparing UserVerificationRequirement during WebAuthn authentication, when using distributed HTTP session stores. An attacker can bypass user verification by...

PT-2026-80261

Summary MyAccountController::postAccountInfoForm allows an authenticated user to update the authentication column default: email without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's session ends: the new email...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the AmqpAppender. An attacker can intercept or modify sensitive log data by performing a man-in-the-middle attack on the TLS connection, as hostname verification is disabled by default. Remediation...

PT-2026-79515

Name of the Vulnerable Software and Affected Versions Firebase Authentication WordPress plugin versions prior to 1.7.1 Description An issue exists where the plugin fails to verify the email address within an authentication token before matching it to a WordPress account and issuing a session. Thi...

PT-2026-78895

Name of the Vulnerable Software and Affected Versions JSON Options versions prior to 0.0.5 Description The JSON Options WordPress plugin lacks capability checks and nonce verification on an action that executes on every request. This allows unauthenticated users to update arbitrary WordPress...

CVE-2026-62834: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-73253: Improper Certificate Validation

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

CVE-2026-72861: Improper Verification of Cryptographic Signature

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

PT-2026-80292

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

RHEL 9 : kbd (RHSA-2026:57610)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57610 advisory. The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font...

ALSA-2026:57610 Moderate: kbd security update

The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files. Security Fixes: kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-726...

RHEL 10 : kbd (RHSA-2026:57597)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57597 advisory. The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font...

PT-2026-80740

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...