CVE-2026-110607 BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request...

EUVD-2026-101235

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request...

CVE-2026-110607 BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request...

K000162606: NGINX ngx_http_ssl_module vulnerability CVE-2026-97629

Security Advisory Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared: : without an explicit sslsessionticketkey file directive to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a...

EUVD-2026-101034

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...

curl: curl: redirect to SFTP or SCP bypasses host verification

A flaw was found in the curl command-line tool. When configured to follow redirects to Secure File Transfer Protocol SFTP or Secure Copy Protocol SCP destinations, curl fails to apply user-specified Secure Shell SSH host verification settings. A malicious server can exploit this flaw by redirecti...

curl: curl: knownhost callback mismatches key as missing

A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell SSH connection c...

CVE-2026-82844

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

EUVD-2026-100976

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

Security update for python312

This update for python312 fixes the following issues: CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free bsc1283969. CVE-2026-19553: omitted serverhostname arguments in wrapbio can cause silent hostname verification bypasses bsc1283826...

SUSE-SU-2026:4659-1 Security update for python312

This update for python312 fixes the following issues: - CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free bsc1283969. - CVE-2026-19553: omitted serverhostname arguments in wrapbio can cause silent hostname verification bypasses bsc1283826. -...

CURL-CVE-2026-86410 redirect to SFTP or SCP bypasses host verification

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

redirect to SFTP or SCP bypasses host verification

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

SUSE-SU-2026:4658-1 Security update for libtcnative-2-0

This update for libtcnative-2-0 fixes the following issues: - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash bsc1282623. - CVE-2026-86246: insecure ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF and...

React2Shell-Vulnerability-Verification-Script

React2Shell Vulnerability Verification Script verifyreactvulnerability.py What is this script? This is a simple, standalone Python script created to help you quickly determine if your project is affected by the critical React2Shell vulnerability also known as CVE-2025-55182. It performs a two-lev...

CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means --knownhosts, --hostpubsha256, and --hostpubmd5 are never installed when the initial URL is HTTPS. If...

kit-jwt

kit-jwt JSON Web Token JWT encoding and decoding for Kit TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit LICENSE| MIT license file README.md| This file...

trivysupplychainanalysis

Quantitative Analysis of Multi-Stage CI/CD Supply-Chain Attacks A formally verified, quantitative reconstruction of the March-2026 Trivy / "TeamPCP" GitHub Actions supply-chain compromise CVE-2026-33634 — modeled in TLA+, checked exhaustively with TLC, and quantified with the PRISM probabilistic...

Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass

IKEv1 key exchange contains a broken authentication caused by logic flow weakness in Remote Access and Mobile Access certificate validation, letting unauthenticated remote attackers bypass user authentication and establish VPN connections without valid passwords, exploit requires use of deprecate...

CLEANSTART-2026-NB78178 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

CVE-2026-59969 affects multiple packages. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. See references for individual vulnerability details...