EUVD-2026-68680

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

CVE-2026-82813

CVE-2026-82813 affects TubeBuddy for YouTube Extension (BEN Group) up to version 5.8.4 on Chrome. The vulnerability resides in the TBGlobal.GetToken function within the file tubebuddymaster1.js , where insufficient verification of data authenticity occurs when the argument t/c/r is manipulated. A...

CVE-2026-82813 BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

PT-2026-83936

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mc (UTSA-2026-093026)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093026 advisory. An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. A...

Devolutions Remote Desktop Manager 2026.1.x < 2026.1.25.0 / 2026.2.x < 2026.2.18.0 Insufficient Data Authenticity Verification (CVE-2026-78417)

The version of Devolutions Remote Desktop Manager installed on the remote host is 2026.1.x prior to 2026.1.25.0 or 2026.2.x prior to 2026.2.18.0. It is, therefore, affected by a vulnerability: - Insufficient verification of data authenticity in the IronVNC client allows an on-path attacker to...

PYSEC-2026-3774

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

CVE-2026-81695

openssl_encrypt versions before 1.4.9 are affected by a terminal injection vulnerability. During decrypt auto-detection, attacker-controlled key_id values are printed to stderr without proper escaping, allowing an attacker to craft encrypted files containing escape sequences that repaint terminal...

The vulnerability of the `sip_help_tcp()` function in the `net/netfilter/nf_conntrack_sip.c` module of the `netfilter` component of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the siphelptcp function in the net/netfilter/nfconntracksip.c module of the netfilter component of the Linux operating system is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow a remote attacker to compromise the...

EUVD-2026-65063

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

ROS-20260824-73-0019

Vulnerability of .NET software platforms and the Microsoft .NET Framework is related to insufficient verification of data authenticity. Exploitation of this vulnerability can allow attackers operating remotely to bypass existing security mechanisms...

ROS-20260824-73-0020

Vulnerability of .NET software platforms and the Microsoft .NET Framework is related to insufficient verification of data authenticity. Exploitation of this vulnerability can allow attackers operating remotely to bypass existing security mechanisms...

ROS-20260824-73-0018

Vulnerability of .NET software platforms and the Microsoft .NET Framework is related to insufficient verification of data authenticity. Exploitation of this vulnerability can allow attackers operating remotely to bypass existing security mechanisms...

CVE-2026-58001

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-58003 WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...

CVE-2026-58003

WWBN AVideo through commit 9c39d8c8 is affected by a cross-site request forgery (CSRF) vulnerability in the releaseVideoNow.json.php endpoint. The endpoint lacks authenticity checks and accepts GET requests , allowing an attacker to craft a malicious cross-site GET request carrying an administrat...

PT-2026-79539

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit 9c39d8c8 Description Cross-site request forgery occurs in the 'releaseVideoNow.json.php' endpoint because it lacks authenticity checks and accepts GET requests. An attacker can craft a malicious cross-site...

CVE-2026-62204: Insufficient Verification of Data Authenticity

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across...

CVE-2026-68554: Insufficient Verification of Data Authenticity

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...