PT-2026-71966

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

VulnCheck KEV: CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

USTP-Secure — Updated!

USTP USTP means UDP Speedy Transmission Protocol. USTP keeps the same authenticated transport model, but the project name is now simply USTP again. By default, USTP uses AEAD for DATA. It also supports an optional negotiated cleartext + HMAC mode for DATA, where payload bytes are visible on the...

PT-2026-71923

Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.3 OpenChoreo versions prior to 1.1.3 OpenChoreo versions prior to 1.2.0-rc.2 Description The 'POST /api/v1alpha1/autobuild' endpoint in 'internal/openchoreo-api/api/handlers/webhook handler.go' allows...

SUSE CVE-2026-58426

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write...

EUVD-2026-55562

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

PT-2026-69776

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where the auth hmacs array within struct sctp cookie is incorrectly sized. The array is intended to store a complete SCTP AUTH HMAC ALGO...

Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference

The key-value KV cache is the primary throughput optimization in modern large language model LLM inference, enabling prefix reuse across requests. In multi-tenant deployments this cache is shared across tenants, creating a timing side channel: an adversarial tenant can reconstruct another tenant'...

Security update for perl-Mojo-JWT (moderate)

openSUSE Security Update: Security update for perl-Mojo-JWT Announcement ID: openSUSE-SU-2026:0279-1 Rating: moderate References: 1271935 Cross-References: CVE-2026-9537 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...

EUVD-2026-53920

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

CVE-2026-15459 WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-15656

CVE-2026-15656 affects IBM Maximo Application Suite (MAS) 9.2, 9.1, and 9.0. The issue is that authorization tokens and session cookies are not marked with the Secure attribute, allowing cookies to be exposed if a user visits an http link or a site containing such a link. As described in the conn...

CVE-2026-18531 IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret...

CVE-2026-18531

CVE-2026-18531 affects IBM Maximo Application Suite (MAS) versions 9.0, 9.1, and 9.2. The issue is due to a weak HMAC session signing secret, which could allow a remote attacker to tamper with session data. The consequence is potential session integrity loss without requiring user interaction. Ac...

CVE-2026-17532

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

EUVD-2026-53203

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or...

PT-2026-68017

Name of the Vulnerable Software and Affected Versions Seraphinite Accelerator versions prior to 2.29.16 Description Unauthenticated attackers can inject arbitrary web scripts into pages by tricking a user into clicking a specially crafted link. This occurs via the 'seraph accel prep' parameter. T...

PT-2026-68202

Name of the Vulnerable Software and Affected Versions IBM Maximo Application Suite versions 9.0 through 9.2 Description A remote attacker can tamper with session data because the system uses a weak HMAC Hash-based Message Authentication Code session signing secret. HMAC is a specific type of...

Linux Distros Unpatched Vulnerability : CVE-2026-53501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's HMAC validation can be bypassed due to the use of Python's .replace wh...