CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-107852

In Jexactyl (a game management and billing system), a vulnerability exists prior to version 4.0.5 in the POST /api/client/billing/stripe/process endpoint. The system fails to verify if the amount_total or currency of a client-supplied Stripe Checkout Session matches the referenced order's require...

CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

EUVD-2026-95982

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

Malicious code in bungoma (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

GHSA-JQ7H-WRVP-3RGX pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated. pyLoad authorizes each request from values copied into the Flask session at login. setsession in webui/app/helpers.py writes role and...

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated. pyLoad authorizes each request from values copied into the Flask session at login. setsession in webui/app/helpers.py writes role and...

GHSA-889W-M37P-88M5 pyLoad: Api.set_user_permission never invalidates the target's session

Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented /api/ RPC surface — e.g. POST /api/setuserpermission or its legacy alias /api/setUserPermission — updates the target's database row but never invalidates that user's existing Flask cookie...

CVE-2026-108103

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsedroppeddltrafficthreshold that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 wi...

CVE-2026-108102

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...

CVE-2026-107808 Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password...

CVE-2026-108102 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...

CVE-2026-108102

The Open5GS project (versions through 2.8.0 ) contains a heap out-of-bounds read vulnerability within the ogs_pfcp_parse_volume_measurement() function in lib/pfcp/types.c. This flaw allows remote unauthenticated attackers to read past Information Element (IE) buffers by sending a PFCP Session Rep...

CVE-2026-92414

A flaw was found in jackrabbit-webdav. The WebDAV Web Distributed Authoring and Versioning server attaches a cached authenticated session when request header tokens—such as lock, transaction, or subscription identifiers—match, without verifying user credentials. An unauthenticated remote attacker...

BIT-GHOST-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

BIT-GHOST-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

BIT-GHOST-2026-103279 Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password...

BIT-GHOST-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

BIT-APISIX-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

Security update for grafana, system-user-grafana

This update for grafana, system-user-grafana fixes the following issues: Update to version 12.4.10: Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials bsc1275934 CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver...