CVE-2026-18152 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...

CVE-2026-94462

The open source e-commerce solution Spree is vulnerable to a broken access control (IDOR) issue in versions 5.4.0 through 5.4.4 and 5.5.4 . The vulnerability exists in the Spree::Api::V3::Store::CartsController#associate method, where the PATCH /api/v3/store/carts/:id/associate endpoint uses find...

CVE-2026-85995

Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace ...

CVE-2026-85995

The source code editor Notepad++ is vulnerable in versions 8.9.7 through 8.9.8 due to an improper verification of cryptographic signatures . The updater and signature verification path can accept a modified GUP.exe file where the Authenticode digest is invalid, yet the embedded certificate metada...

CVE-2026-85995 Notepad++: Authenticode verification bypass allows modified updater execution

Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace ...

CVE-2026-85995 Notepad++: Authenticode verification bypass allows modified updater execution

Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace ...

CVE-2026-85995 Notepad++: Authenticode verification bypass allows modified updater execution

Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace ...

EUVD-2026-84575

Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace ...

SUSE CVE-2026-93601

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

mvt v2026.9.21

Mobile Verification Toolkit !IMPORTANT We recently merged the "v3" branch. This introduced breaking changes. If you relied on mvt output in other scripts They might have broken. More details: https://github.com/mvt-project/mvt/issues/757 Mobile Verification Toolkit MVT is a collection of utilitie...

org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification

A flaw was found in Bouncy Castle for Java. During the RSA PKCS1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Using Paybis as a Crypto On-Ramp in 2026: Fees, Wallets and Checks

Paybis offers crypto on-ramp and off-ramp services with cards, bank transfers and wallets. Learn about its fees, verification, security and regional availability...

PT-2026-96668

Name of the Vulnerable Software and Affected Versions ThumbPress versions prior to 6.2.2 Description Authenticated users with Subscriber-level access and above can deactivate the plugin by sending a crafted POST request to the 'admin-ajax' endpoint. This occurs because the send deactivation surve...

CVE-2026-18152: Improper Verification of Cryptographic Signature

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...