CVE-2024-50478

CVE-2024-50478 1-Click Login: Passwordless Authentication 1.4.5 - Authentication Bypass via Account Takeover Description: The 1-Click Login: Passwordless Authentication plugin for WordPress is vulnerable to authentication bypass in version 1.4.5. This is due to the plugin not properly verifying a...

CVE-2026-91187

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

CVE-2026-91187

The dashbit nimble_zta library (versions 0.1.2 before 0.1.3 ) contains an improper verification of cryptographic signature vulnerability. Specifically, the verify_token/2 function in lib/nimble_zta/cloudflare.ex calls JOSE.JWT.verify/2 but fails to check the boolean verification result, returning...

CVE-2026-91187 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

EUVD-2026-85871

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

CVE-2026-92400

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...

CVE-2026-9090-poc

CVE-2026-9090 — Bypass de firma SAML en Casdoor PoC Prueba de concepto para CVE-2026-9090 CWE-347, Verificación incorrecta de la firma criptográfica, un bypass de autenticación en la plataforma de identidad Casdoor. Atribución. CVE-2026-9090 fue publicado y coordinado por CERT/CC — ver VU780781...

EUVD-2026-83511

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that...

The vulnerability of the `execve` system call in FreeBSD’s kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the execve system call in FreeBSD operating systems is related to improper verification of removed users. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

CVE-2026-59163: Improper Verification of Cryptographic Signature

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

CVE-2026-84906

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors ...

CLEANSTART-2026-OB74177 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5

Multiple security vulnerabilities affect the spring-boot package. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...

CLEANSTART-2026-EC45528 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5

Multiple security vulnerabilities affect the apache-nifi package. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...

Security Advisory 0182

Security Advisory 0182 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-86109 CVSSv3.1 Base Score: 6.6...

CVE-2026-69646

Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network...

EUVD-2026-73939

Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network...

CVE-2026-69646

CVE-2026-69646 is an improper verification of cryptographic signature vulnerability in Skype for Business Server (Subscription Edition, 2015, and 2019). An unauthorized attacker on an adjacent network can perform spoofing without requiring privileges or user interaction. The CVSS 3.1 score is 8.3...

CVE-2026-57098

Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network...

EUVD-2026-73176

Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network...

Skype for Business Spoofing Vulnerability

Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network...