PT-2026-63398

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description When the Telerik.Upload.ConfigurationHashKey is absent and the machineKey is not explicitly configured, the integrity protection for upload metadata may revert to a predictable defau...

CVE-2026-61165

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided...

CVE-2026-61154

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided...

CVE-2026-61163: Improper Authentication

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2026-61154: Improper Privilege Management

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided...

PT-2026-63041

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search Platform Services version 11.4.0 Description An issue exists in the Forge component of Oracle Commerce Guided Search Platform Services. An unauthenticated attacker with network access via HTTPS can compromise the...

CVE-2026-61156: Improper Access Control

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Commerce Guided...

CVE-2026-61155: Improper Access Control

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided...

PT-2026-63039

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search Platform Services version 11.4.0 Description An issue exists in the Forge component of Oracle Commerce Guided Search Platform Services. An unauthenticated attacker with network access via HTTP can exploit this fla...

CVE-2026-61165: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided...

PT-2026-63048

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Forge component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can...

EUVD-2026-45282

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user...

CVE-2026-9537

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of...

PT-2026-60862

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description An authenticated attacker can read arbitrary files, including the JWT signing key. This allows the attacker to forge authentication tokens for any user. JWT JSON Web Token is a compact...

CVE-2026-7872: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user...

CVE-2026-11575: Missing Authorization

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash...

CVE-2026-61436 PraisonAI before 4.6.78 Missing Webhook Signature Verification

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...

CVE-2026-61436 PraisonAI before 4.6.78 Missing Webhook Signature Verification

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...

node-forge Signature Forgery Vulnerabilities in RSA-PKCS and ED25519 Implementations

Overview Two distinct cryptographic signature verification vulnerabilities exist in Digital Bazaar node-forge, a widely used JavaScript library implementing cryptographic primitives for Node.js and browser environments. These vulnerabilities allow attackers to forge RSA PKCS1 v1.5 and Ed25519...

MAL-2026-10559 Malicious code in avatar-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79e52ebdc93b154163545b64642ea4c4016c4a69692c6f9e20e283cce3842770 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...