cve-2026-47777

CVE-2026-47777 — Mastodon Featured Collections Authorization Bypass Overview I responsibly disclosed a High Severity Authorization Bypass vulnerability affecting Mastodon's experimental Featured Collections federation pipeline. CVE ID: CVE-2026-47777 Affected Component...

CVE-2024-9106

CVE-2024-9106 Wechat Social login = 1.3.0 - Authentication Bypass Description: The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login...

CVE-2026-118377

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

CVE-2026-118377

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

CVE-2026-118377 mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

EUVD-2026-111553

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

CVE-2026-118377

The mews/pos software (up to version 2.0.0 ) is vulnerable to an insufficient verification of data authenticity (CWE-345) in its 3D Pay and 3D Host handlers. Specifically, the GarantiPos , PayForPos , and InterPos handlers fail to invoke the check3DHash() function. This allows unauthenticated att...

CVE-2026-118377 mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

PT-2026-127743

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

Insufficient Verification of Data Authenticity

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via a forged client-supplied uuid field in multimodal content parts, which vLLM uses verbatim as the...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via ownerisstale in src/filelock/soft.py and src/filelock/identity.py, when a process owner identity comparison is performed between a lock holder whose start token was recorded without a...

CVE-2026-103311: Insufficient Verification of Data Authenticity

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...

CVE-2026-55103: Insufficient Verification of Data Authenticity

Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. ...

CVE-2026-82844: Insufficient Verification of Data Authenticity

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-103308: Insufficient Verification of Data Authenticity

The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to...

CVE-2026-102250

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

CVE-2026-102250

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

EUVD-2026-98779

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

CVE-2026-102250

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

PT-2026-111616

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...