JLSEC-2026-1148

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupti...

JLSEC-2026-1151

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny...

CVE-2026-15931 Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes...

CVE-2026-15931

The Simple Membership WordPress plugin, in versions before 4.7.8 , is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin fails to sanitise a subscriber name value received from an unauthenticated payment approval request and fails to escape it when rendered in the admin...

CVE-2026-15931 Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes...

Authorization Bypass

@better-auth/stripe is vulnerable to Authorization Bypass. The vulnerability is due to inconsistent organization ID validation between the middleware and request handler, allowing authenticated users to perform unauthorized subscription actions and access billing information for other organizatio...

PT-2026-67540

Name of the Vulnerable Software and Affected Versions NASA cFS version 7.0.1 Description Incorrect access control allows attackers to arbitrarily remove low-index subscriptions and add new streams by sending TO LAB add/remove subscription commands. Recommendations At the moment, there is no...

CVE-2026-67975

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TOLAB add/remove subscription commands...

CVE-2026-67975: Improper Access Control

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TOLAB add/remove subscription commands...

CVE-2026-67974

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

CVE-2026-67974

A parser boundary flaw exists in the Software Bus Network (SBN) application's peer subscription message handling within NASA cFS v7.0.1 . This vulnerability allows an attacker to trigger a Denial of Service (DoS) by sending a crafted packet . No specific remediation instructions or exploit links ...

CVE-2026-67974: Improper Input Validation

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

PT-2026-67539

Name of the Vulnerable Software and Affected Versions NASA cFS version 7.0.1 Description A parser boundary flaw exists in the Software Bus Network SBN application's peer subscription message handling. This issue allows an attacker to trigger a Denial of Service DoS by sending a specially crafted...

CVE-2026-67975

NASA cFS v7.0.1 is affected by an incorrect access control vulnerability. This flaw allows an attacker to arbitrarily remove low-index subscriptions and add new streams by sending TO_LAB add/remove subscription commands. Exploitation details and specific remediation steps are not provided in the ...

CVE-2026-67974

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

CVE-2026-14920 AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

Summary...

CVE-2026-14920 AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

Summary...

CVE-2026-14920

The AcyMailing SMTP Newsletter WordPress plugin (versions

CVE-2026-67329

@better-auth/stripe versions = 1.4.11 and = 1.7.0-beta.0 and 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the...

CVE-2026-67329 @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription

@better-auth/stripe versions = 1.4.11 and = 1.7.0-beta.0 and 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the...