CVE-2026-85695: Missing Authentication for Critical Function

FastChat contains an authentication bypass vulnerability in the /registerworker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompt...

Linux Distros Unpatched Vulnerability : CVE-2026-85393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed...

PT-2026-85331

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...

PT-2026-85466

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

CVE-2026-65818

Server-side request forgery ssrf in Power Automate allows an authorized attacker to elevate privileges over a network...

CVE-2026-85432 MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party...

CVE-2026-85432

MOOS core-moos through 10.4.0, an underwater robotics middleware, contains a message source spoofing flaw in its MOOSDB message processing layer. The root cause is a failure to validate client identity: the system trusts wire-supplied source identifiers in serialized messages rather than the auth...

node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...

GHSA-86W9-CPQP-85RV node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...

python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

GHSA-3QF3-8W2G-RQMX python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Software Data Center

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-12803 was introduced in 9.12.1 and later of Jira Software Data Center and Server. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Software Data Center and Server

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-12816 was introduced in 9.12.1 and later of Jira Software Data Center and Server. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the HMAC secret guard of jose/backends/native.py, which rejects a key only when ispemformatkey or issshkeykey holds and so never catches DER-encoded binary SubjectPublicKeyInfo public...

Improper Verification of Cryptographic Signature

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in rsa.js, whose DigestInfo validation checks the out...

Improper Verification of Cryptographic Signature

Overview org.webjars.npm:node-forge is a WebJar for node-forge. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in rsa.js, whose DigestInfo validation checks the outer element count obj.value.length !== 2 but never verifies the element count of...

CVE-2026-85393

A flaw was found in node-forge. This vulnerability allows a remote attacker to forge valid RSA PKCS1 v1.5 signatures for arbitrary messages. The flaw occurs because the software fails to properly validate the element count in nested DigestAlgorithm sequences during signature verification. By...

CVE-2026-85394

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

AZL-99750 CVE-2026-85393 affecting package python-tensorboard 2.16.2-6

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...

CVE-2026-85393

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...