CVE-2026-74240

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

CVE-2026-19910

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...

CVE-2026-19910

CVE-2026-19910 affects PAX Technology Q80, specifically the Application Installer. The flaw is a signature verification bypass in the installer, allowing a network-adjacent attacker (no authentication, high attack complexity) to execute arbitrary code with root privileges by installing a signed-b...

EUVD-2026-58802

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...

CVE-2026-49457

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

CVE-2026-49457 QUIC has Broken TLS verification

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

IAM Compliance Requirements and Best Practices

IAM compliance is the practice of demonstrating that identity and access controls are not only documented but actually enforced across users, applications, infrastructure, and non-human identities. This guide explains what IAM compliance requires, which regulations matter, and how organizations...

SUSE CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

Improper Verification Of Cryptographic Signature

Spring Security is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to SAML Responses and LogoutRequest/LogoutResponse elements being decrypted without requiring a valid signature, which allows an attacker to craft malicious SAML payloads and use the Servic...

Improper Certificate Validation

Spring Boot is vulnerable to Improper Certificate Validation. The vulnerability is due to hostname verification being disabled in Mail auto-configuration, which allows an attacker capable of intercepting the SMTP connection to impersonate the intended mail server and potentially access or...

CVE-2026-53970

ZeroBrew 0.3.1 and earlier is affected by a missing integrity verification vulnerability in the Ruby compatibility shim (shim.rb). An attacker could substitute malicious content at formula resources or URL-based patch URLs without checksum validation, allowing remote code execution when downloads...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: slsa-verifier, gh, cosign, cosign-fips...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: slsa-verifier, gh, cosign...

CVE-2026-12949

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

CVE-2026-12949 Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

CVE-2026-12949

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

EUVD-2026-58589

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

CVE-2026-12949

The CVE concerns the Wishlist Member plugin for WordPress, affected in versions up to 3.34.1. The vulnerability arises in wpm_register() where the registration cookie is only validated against the GET reg parameter while POST mergewith and POST wpm_id are accepted without verifying that the refer...

PT-2026-72126

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description Red Hat Quay contains flaws in the validation of JSON Web Tokens JWT used for single sign-on SSO authentication and federated robot accounts. The issues involve improper audience...

oslo.messaging: openstack: OpenStack oslo.messaging: Man-in-the-middle attack via improper TLS hostname verification

A flaw was found in OpenStack oslo.messaging. The RabbitMQ driver does not properly verify the hostname of the message broker when establishing a TLS Transport Layer Security connection. An attacker capable of intercepting control-plane network traffic can exploit this vulnerability to impersonat...