CVE-2026-49467

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

CVE-2026-49467

CVE-2026-49467 affects Pingvin Share X (versions 1.5.0 through 1.18.0). The root cause is a missing await on asynchronous calls to verifyPassword (authTotp.service.ts) and authenticateUser (auth.service.ts). In JavaScript, an unawaited Promise is truthy, so the intended ForbiddenException when a ...

CVE-2026-49467 TOTP enrollment hijack: password gate skipped due to unawaited promise

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

CVE-2026-63362

A flaw was found in open62541. An unsigned integer underflow in the PubSub signature verification path may allow a remote attacker to cause a denial of service by sending a specially crafted User Datagram Protocol UDP packet. This vulnerability could make the affected system unavailable to...

CVE-2026-68757

CVE-2026-68757 concerns JFrog Artifactory where a user with a valid SAML response may impersonate another user due to a potential improper SAML signature verification. The connected documents corroborate the basic vulnerability description and label it in CVE lists as a potential SAML-signature-v...

CVE-2026-68757 Potential improper SAML signature verification in JFrog Artifactory

A user with access to a valid SAML response may impersonate another user under specific conditions...

EUVD-2026-57176

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid...

EUVD-2026-57173

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

CVE-2026-16621

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

Security Bulletin:Vulnerability in crypto affects IBM Netezza Appliance

Summary The crypto package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-27145 Vulnerability Details CVEID:CVE-2026-27145 DESCRIPTION:x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name...

EUVD-2026-57089

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value...

CVE-2026-16538 TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value...

CVE-2026-16538 TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value...

PT-2026-71055

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid...

PT-2026-71052

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

PT-2026-71174

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

PT-2026-71209

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

SUSE SLED15: bouncycastle / bouncycastle-pg / bouncycastle-pkix / etc (SUSE-SU-2026:3559-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3559-1 advisory. - CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI bsc1272700. - CVE-2026-12185:...

DEBIAN-CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...