GHSA-MFXH-VP55-7GC6 Contao: The registration module re-sends activation mails

ModuleRegistration::compile reaches its follow-up registration branch on any POST to a page carrying the module. That branch checks neither FORMSUBMIT nor the captcha result computed immediately above it, and resendActivationMail leads to OptInToken::send, which has no rate limit at all. Impact...

Contao: The registration module re-sends activation mails

ModuleRegistration::compile reaches its follow-up registration branch on any POST to a page carrying the module. That branch checks neither FORMSUBMIT nor the captcha result computed immediately above it, and resendActivationMail leads to OptInToken::send, which has no rate limit at all. Impact...

Contao: Improper access control in the preview links module

core-bundle/config/services.yaml registers the preview access voter with the class Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter, but the class shipped on disk is named PreviewVoter. Symfony resolves the class with getReflectionClass$class, false, gets null, silently skips the...

CVE-2026-107852

In Jexactyl (a game management and billing system), a vulnerability exists prior to version 4.0.5 in the POST /api/client/billing/stripe/process endpoint. The system fails to verify if the amount_total or currency of a client-supplied Stripe Checkout Session matches the referenced order's require...

CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-107850

The Contao Open Source CMS is vulnerable to improper access control in the preview links module from versions 5.7.1 until 5.7.12 . The root cause is a configuration error in core-bundle/config/services.yaml, where the preview access voter is registered under an incorrect class name. This causes S...

CVE-2026-107850 Contao: Improper access control in the preview links module

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...

EUVD-2026-95980

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...

CVE-2026-107850 Contao: Improper access control in the preview links module

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...

CVE-2026-107843 Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...

CVE-2026-107843 Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...

SUSE-SU-2026:4612-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-78030: arbitrary modules loaded due to unvalidated dbmtype and dbmmldbm attributes in DBD::DBM bsc1281704. - CVE-2026-88815: numeric value incorrectly treated as strings in sqltypecastsvpv allows for process crash bsc1283055. -...

Security Bulletin: Security vulnerability in Golang affects IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in Golang affects IBM Robotic Process Automation. Golang is used by IBM Robotic Process Automation as part of its deployment. This bulletin identifies the fixes required to resolve the vulnerabilities. Vulnerability Details CVEID:CVE-2026-56864 DESCRIPTION: A...

CVE-2026-86405

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1...

CVE-2026-85531

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1...

EUVD-2026-95755

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1...

CVE-2026-86405 Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1...

CVE-2026-86405

The Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module is affected by an improper verification of cryptographic signature vulnerability. This flaw allows for Signature Spoofing due to improper validation within the module. The vulnerability specifically affects version...

EUVD-2026-95747

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1...

CVE-2026-85531 Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1...