EUVD-2026-85520

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

CVE-2026-65583

A flaw was found in Apache CXF. The OpenID Connect OIDC relying-party token validation in Apache CXF could accept specially crafted self-issued ID tokens. This bypasses necessary claim checks, such as issuer, subject, audience, and time, leading to an authentication bypass. This vulnerability...

SUSE CVE-2026-92745

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management RHSM offline token. The token is exposed when it is passed as a command-line argument to a helper script during the...

SUSE CVE-2026-93565

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. Th...

SUSE CVE-2026-93574

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

DRUPAL-CONTRIB-2026-175

The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code wh...

DRUPAL-CONTRIB-2026-170

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Forms may be displayed in blocks. Webform does not sufficiently validate an optional token query...

CVE-2026-77112 SSRF Leading to JWT Token Disclosure in Global IT Informatics' Weoll

Server-Side request forgery SSRF vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery. This issue affects Weoll: before 3.2.45.44...

CVE-2026-77112 SSRF Leading to JWT Token Disclosure in Global IT Informatics' Weoll

Server-Side request forgery SSRF vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery. This issue affects Weoll: before 3.2.45.44...

Security update for python-WebOb

This update for python-WebOb fixes the following issues: CVE-2026-54770: an unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft bsc1275917. Patch Instructions: To install this SUSE upda...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in nanoid (CVE-2026-73086)

Summary A predictable unique ID generation vulnerability in the nanoid generator library CVE-2026-73086 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.3.17. Vulnerability Details CVEID:CVE-2026-73086 DESCRIPTION: nanoid is a secure,...

CVE-2026-87979

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-83555

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

WordPress Paymob for WooCommerce plugin < 4.1.14 - Unauthenticated Saved Card Token Write to Any User vulnerability

Unauthenticated Saved Card Token Write to Any User vulnerability discovered by Salúa Es-sair in WordPress Plugin Paymob for WooCommerce versions 4.1.14...

CVE-2026-89331

The FluentBoards WordPress plugin (versions 1.95-2.0.15 ) is vulnerable to an unauthenticated board member email address disclosure vulnerability. The flaw exists because the plugin fails to properly restrict member data returned by its public, token-shared board feature . This allows unauthentic...

EUVD-2026-85053

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

CVE-2026-87979 Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-87979 Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-87979

The Paymob for WooCommerce WordPress plugin, in versions before 4.1.14 , is vulnerable to a security flaw where it fails to verify the request signature on the card-token branch of its payment webhook. This lack of authorization allows unauthenticated attackers to write a card-token record to any...

EUVD-2026-85049

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...