Capture-The-Flag

Capture-The-Flag...

CVE-2026-80342

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...

EUVD-2026-85027

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...

MAL-2026-16441 Malicious code in moidevl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76b05c7a5581562edc719cbaaf2f6b317d322a6a2ef96c9fc905b53394e42101 Despite a README describing a 'Windows diagnostic utility,' the package implements an anti-proctoring overlay for cheating on remote exams Safe Exam...

CVE-2026-80342: Authorization Bypass Through User-Controlled Key

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...

PT-2026-97163

Name of the Vulnerable Software and Affected Versions Payment Plugins for PayPal WooCommerce WordPress plugin versions prior to 2.0.27 Description The plugin fails to verify if a PayPal order provided in a payment request corresponds to the WooCommerce order being processed, provided the PayPal...

Malicious code in nodetokyo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ec0e3f7b963353d4d2928e12ca3898cce5100ed3e3537383faa9c7f9a93f203 The package's declared main launcher.js executes launch at module top level, so require'nodetokyo' automatically installs Python 3.12 via winget or b...

MAL-2026-16388 Malicious code in nodetokyo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ec0e3f7b963353d4d2928e12ca3898cce5100ed3e3537383faa9c7f9a93f203 The package's declared main launcher.js executes launch at module top level, so require'nodetokyo' automatically installs Python 3.12 via winget or b...

Exploit for CVE-2026-84388

FortiPAM Chrome Extension UI Layer RCE PoC - CVE-2026-84388...

CVE-2026-87119

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

CVE-2026-87119

CVE-2026-87119 is an authentication bypass by capture-replay in ZenHive mpp (Elixir), affecting versions 0.14.0 through 0.16.1 . The root cause lies in MPP.Methods.Tempo.KeyAuthorization.verify/3: the payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits, and sc...

CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

EUVD-2026-84361

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

EEF-CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

Summary Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying ...

PT-2026-96708

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1 Description An authentication bypass via capture-replay allows an attacker with a captured subscription activation credential to repeatedly charge a payer. The issue occurs because the payer signs a...

tcpdump 4.99.7

tcpdump allows you to dump the traffic on a network. It can be used to print out the headers and/or contents of packets on a network interface that matches a given expression. You can use this tool to track down network problems, to detect many attacks, or to monitor the network activities...

CVE-2026-87119: Authentication Bypass by Capture-replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

China-Linked FamousSparrow Deploys SparroWocky Backdoor in Latin America

FamousSparrow is targeting Latin American governments with SparroWocky, a new C++ backdoor that exfiltrates files, takes screenshots and evades security tools...