dnstake

DNSTake A fast tool to check missing hosted DNS zones that can lead to subdomain takeover. What is a DNS takeover? DNS takeover vulnerabilities occur when a subdomain subdomain.example.com or domain has its authoritative nameserver set to a provider e.g. AWS Route 53, Akamai, Microsoft Azure, etc...

Astra Linux – Vulnerability in Linux 5.10, Linux

Before version 5.17.9, the Linux kernel allowed TCP servers to identify clients by observing which source ports were used. This occurs due to the use of Algorithm 4 "Double-Hash Port Selection Algorithm" from RFC 6056...

CVE-2026-93528

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

CVE-2026-93528

The NP Quote Request for WooCommerce WordPress plugin (versions 2.0-2.4.15 ) is vulnerable to unauthenticated order data disclosure . The root cause is located in the gpls_woo_rfq_get_rfq_cart() function within includes/classes/gpls_woo_rfq_functions.php, which fails to validate order ownership w...

WordPress NP Quote Request for WooCommerce plugin 2.0-2.4.15 - Unauthenticated Order Data Disclosure vulnerability

Unauthenticated Order Data Disclosure vulnerability discovered by Murad Islamzada in WordPress Plugin NP Quote Request for WooCommerce versions 2.0-2.4.15...

CVE-2026-93528 NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

EUVD-2026-85064

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

CVE-2026-93528 NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

PT-2026-97201

Name of the Vulnerable Software and Affected Versions NP Quote Request for WooCommerce WordPress plugin versions prior to 2.4.16 Description An issue exists where the software fails to verify order ownership before rendering order details. This allows unauthenticated attackers to view the orders ...

CVE-2026-93528: Exposure of Sensitive Information to an Unauthorized Actor

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

PT-2026-69277

Name of the Vulnerable Software and Affected Versions PiWeb Cancel order / Refund request for WooCommerce WordPress plugin versions prior to 1.3.4.34 Description Lack of authorization and ownership checks when adding previous order contents to the cart allows unauthenticated users to disclose the...

RFE Standards

Minimum Viable Standard MVS & Request for Evidence RFE Framework - Decompose bloated, legacy RFCs X.509/ASN.1 and RFC 3986 URIs into usage-driven, empirical standards. Coverage is dictated by observable real-world usage data plus an explicit Criticality Override Registry - not design-by-committee...

CVE-2026-14440

Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the customer's zone. This auto-managed RRset is permissive by design e.g. 'issue "letsencrypt.org"' without parameters. On Universal SSL zones,...

GO-2026-5768 ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) in github.com/zitadel/zitadel

ZITADEL: Missing clientid binding in OIDC authorization code exchange and refresh token flows RFC 6749 Section 4.1.3 violation in github.com/zitadel/zitadel...

CVE-2026-6412

Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing...

CVE-2026-6412 Continued acceptance of SHA-1/MD5 digests in certificate processing

Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing...

PT-2026-52584

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description There are certificate policy and RFC 8446 compliance concerns due to the continued acceptance of SHA-1 and MD5 hashing algorithms during certificate processing...

OPENSUSE-SU-2026:21054-1 Security update for dracut

This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: - Update to version 059+suse.722.gdd9d67ff5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...

[SECURITY] Fedora 43 Update: ongres-scram-3.3-1.fc43

This is a Java implementation of SCRAM Salted Challenge Response Authentication Mechanism which is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms. It is described as part of RFC 5802 and RFC7677...

[SECURITY] Fedora 44 Update: perl-Mojo-JWT-1.02-1.fc44

JSON Web Token is described in https://tools.ietf.org/html/rfc7519. Mojo::JWT implements that standard with an API that should feel familiar to Mojolicious users though of course it is useful elsewhere. Indeed, JWT is much like Mojolicious::Sessions except that the result is a URL-safe text strin...