CVE-2026-84027

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions 8.9.1-8.9.4 is vulnerable to a paid order and payment record forgery vulnerability. The root cause is a failure to check user capabilities when creating orders via the plugin's REST API . This allo...

CVE-2026-84027 Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 8.9.1-8.9.4 - Subscriber+ Paid Order and Payment Record Forgery vulnerability

Subscriber+ Paid Order and Payment Record Forgery vulnerability discovered by LevinityCyber in WordPress Plugin Directorist versions 8.9.1-8.9.4...

CVE-2026-12816

A flaw was found in Bouncy Castle for Java. This vulnerability allows for Message Authentication Code MAC forgery in the IESEngine stream-mode. The issue arises from a length-dependent Key Derivation Function KDF split, which an attacker could exploit to bypass integrity checks. This could lead t...

CVE-2026-95930

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

CVE-2026-95930

The iFlytek astron-agent (up to version 1.0.6 ) is vulnerable to a server-side request forgery (SSRF) . The flaw exists in the UrlCheckTool.checkUrl function within the debugToolV2 API endpoint, where a remote attacker can manipulate the endPoint argument to initiate unauthorized requests. To rem...

CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

EUVD-2026-85001

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

EUVD-2026-84946

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...

EUVD-2026-84959

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

EUVD-2026-84943

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization...

CVE-2026-92930

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a...

SUSE CVE-2026-77119

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...

CVE-2026-84718: Use of Less Trusted Source

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

PT-2026-97583

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An issue exists in the trust-store plugin where the verify fun...

Linux Distros Unpatched Vulnerability : CVE-2026-94108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on...

PT-2026-97662

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...

Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...