WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Order Key Disclosure vulnerability

Unauthenticated Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payments for Hubtel versions 1.0.2...

EUVD-2026-90518

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

CVE-2026-96173 Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

CVE-2026-96173 Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

CVE-2026-96173

The Payments for Hubtel WordPress plugin, in versions prior to 1.0.2 , contains an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the plugin fails to verify if a requester is authorized to view an order before redirecting a public payment-callback request. This all...

CVE-2026-101148

The BackupSheep WordPress Backup Plugin (versions through 1.8 ) is vulnerable to unauthenticated access due to improper validation of its integration key . The plugin treats unset or blank keys as valid, enabling attackers to create and download full site backups —including databases with user pa...

CVE-2026-82827

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82827 A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

EUVD-2026-90492

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82827 A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82827

The Hitachi Coding Software Suite (versions through 3.3.0 ) is vulnerable to a Use of Hard-coded Cryptographic Key flaw. The software uses a hard-coded JWT signing secret key , which enables an attacker to generate unauthorized Bearer tokens . By using these fraudulent tokens, an attacker can exp...

Exploit for CVE-2026-96349

CVE-2026-96349 — WordPress SiteSkite ≤ 2.1.8 → unauthenticated...

CLEANSTART-2024-TG46953 Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1

Security vulnerability affects the krb5 package. The Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1...

CLEANSTART-2026-TP37792 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

CVE-2026-32283 affects multiple packages. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. See references for individual vulnerability details...

CLEANSTART-2026-GK62523 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CLEANSTART-2026-UN16903 Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly

Security vulnerability affects the apache-nifi package. The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly...

CLEANSTART-2026-GM89854 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

Security vulnerability affects the kube-state-metrics-fips package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...

CLEANSTART-2026-LM88265 RSA and DSA public key parsers did not enforce size limits on key parameters

Security vulnerability affects the kube-state-metrics-fips package. The RSA and DSA public key parsers did not enforce size limits on key parameters...

CLEANSTART-2026-HN45424 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh

Security vulnerability affects the kube-state-metrics-fips package. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh...

PT-2026-105130

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupte...