CVE-2026-107097 Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses...

WordPress Royal Addons for Elementor plugin 1.3.71-1.7.1069 - Unauthenticated Mailchimp Audience Injection vulnerability

Unauthenticated Mailchimp Audience Injection vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Royal Elementor Addons versions 1.3.71-1.7.1069...

EUVD-2025-5571

Malicious code in bioql PyPI...

CVE-2025-27370

OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the privatekeyjwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issu...

CVE-2025-27370

OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the privatekeyjwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issu...

CVE-2025-27370

OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the privatekeyjwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issu...

PT-2025-9529

Name of the Vulnerable Software and Affected Versions OpenID Connect Core versions prior to 1.0 errata set 3 Description The issue allows audience injection in certain situations when the private key jwt authentication mechanism is used. A malicious Authorization Server could trick a Client into...

CVE-2025-27370

OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the privatekeyjwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issu...

CVE-2025-27370

OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the privatekeyjwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issu...

CVE-2025-27370

CVE-2025-27370 concerns OpenID Connect Core through 1.0 errata set 2. when private_key_jwt authentication is used, an attacker-controlled Authorization Server can induce a Client to accept a manipulated audience value (e.g., other token endpoints or issuer identifiers). This audience injection co...

CVE-2025-27370: Authentication Bypass by Primary Weakness

OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the privatekeyjwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issu...