CVE-2026-102946 | Critical | 9.1 | 2026-10-15 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deseria… |
CVE-2026-55103 | High | 8.6 | 2026-10-15 | Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not… |
CVE-2026-92429 | Medium | 5.3 | 2026-10-15 | The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, al… |
CVE-2026-92428 | Medium | 5.3 | 2026-10-15 | The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, al… |
CVE-2026-103324 | Medium | 5.3 | 2026-10-15 | The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives… |
CVE-2026-104108 | High | 8.1 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC id… |
CVE-2026-102682 | Medium | 5.6 | 2026-10-14 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's… |
CVE-2026-102695 | High | 8.2 | 2026-10-14 | OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structural… |
CVE-2026-66874 | Medium | 6.5 | 2026-10-14 | For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters… |
CVE-2026-110607 | Medium | 6.5 | 2026-10-14 | BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling… |
CVE-2026-88998 | Medium | 5.3 | 2026-10-14 | The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cov… |
CVE-2026-82844 | Medium | 5.3 | 2026-10-14 | The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayP… |
CVE-2026-103308 | Medium | 6.5 | 2026-10-14 | The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret t… |
CVE-2026-108069 | Medium | 5.3 | 2026-10-14 | The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment su… |
CVE-2026-107160 | Medium | 5.3 | 2026-10-14 | The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a requ… |
CVE-2026-102250 | | | 2026-10-13 | CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user be… |
CVE-2026-108971 | Critical | 9.6 | 2026-10-13 | A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recov… |
CVE-2026-49483 | | | 2026-10-12 | Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing… |
CVE-2026-109365 | Low | 3.7 | 2026-10-12 | Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving fo… |
CVE-2026-109359 | High | 7.7 | 2026-10-12 | Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same… |
CVE-2026-108568 | Medium | 4.3 | 2026-10-11 | A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billi… |
CVE-2026-107420 | Medium | 5.3 | 2026-10-10 | Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions. |
CVE-2026-62367 | | | 2026-10-09 | Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback`… |
CVE-2026-107852 | | | 2026-10-09 | Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supp… |
CVE-2026-13257 | Medium | 6.5 | 2026-10-08 | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated… |
CVE-2026-103517 | Medium | 5.3 | 2026-10-08 | The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment pro… |
CVE-2026-107284 | Low | 3.7 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16… |
CVE-2026-105818 | Medium | 5.9 | 2026-10-07 | Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default… |
CVE-2026-107102 | | | 2026-10-07 | This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. A… |
CVE-2026-82212 | High | 7.5 | 2026-10-07 | The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when… |
CVE-2026-16516 | High | 7.4 | 2026-10-07 | wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKe… |
CVE-2026-104850 | High | 7.5 | 2026-10-06 | MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2… |
CVE-2026-59357 | | | 2026-10-06 | Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authe… |
CVE-2026-105741 | High | 7.1 | 2026-10-05 | Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Proto… |
CVE-2026-104805 | | | 2026-10-05 | DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to… |
CVE-2026-105161 | Medium | 5.3 | 2026-10-04 | A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a m… |
CVE-2026-85515 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integ… |
CVE-2026-71887 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no… |
CVE-2026-104422 | High | 7.5 | 2026-10-02 | The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far… |
CVE-2026-104419 | Medium | 4.8 | 2026-10-02 | Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold… |
CVE-2026-103878 | High | 7.5 | 2026-10-02 | Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API.
A StartTLS extended operation started after a Search request has… |
CVE-2026-104056 | Critical | 9.8 | 2026-10-01 | Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poi… |
CVE-2026-102140 | Medium | 4.9 | 2026-09-30 | An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only t… |
CVE-2026-55174 | Medium | 5.9 | 2026-09-30 | UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes… |
CVE-2026-89238 | Critical | 9.1 | 2026-09-30 | WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality cove… |
CVE-2026-13720 | Medium | 5.4 | 2026-09-30 | An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboar… |
CVE-2026-102831 | High | 8.1 | 2026-09-29 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5… |
CVE-2026-102711 | | | 2026-09-29 | Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_tx… |
CVE-2026-102677 | High | 7.8 | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, E… |
CVE-2026-101278 | Medium | 4.3 | 2026-09-29 | A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_… |
CVE-2026-102275 | Medium | 6.5 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because pr… |
CVE-2026-102267 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated… |
CVE-2026-92996 | Medium | 5.3 | 2026-09-28 | The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order own… |
CVE-2026-89411 | Medium | 5.3 | 2026-09-28 | The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauth… |
CVE-2026-100872 | High | 7.5 | 2026-09-27 | Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals a… |
CVE-2026-92161 | Critical | 9.8 | 2026-09-25 | FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth… |
CVE-2026-81630 | High | 8.1 | 2026-09-24 | The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprot… |
CVE-2026-94612 | High | 7.4 | 2026-09-24 | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validi… |
CVE-2026-87978 | Medium | 5.3 | 2026-09-23 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated… |
CVE-2026-81338 | Medium | 4.6 | 2026-09-23 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it a… |
CVE-2026-28324 | Critical | 9.8 | 2026-09-22 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity check… |
CVE-2026-85288 | Medium | 6.7 | 2026-09-22 | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMAC… |
CVE-2026-94455 | High | 7.1 | 2026-09-22 | An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only… |
CVE-2026-49450 | High | 7.1 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publ… |
CVE-2026-92400 | Medium | 5.3 | 2026-09-21 | The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's… |
CVE-2025-12999 | | | 2026-09-21 | UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forw… |
CVE-2026-92422 | Medium | 6.5 | 2026-09-20 | The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes… |
CVE-2026-63405 | Medium | 5.9 | 2026-09-18 | AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go i… |
CVE-2026-62874 | Critical | 10.0 | 2026-09-18 | Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-54608 | | | 2026-09-17 | MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending… |
CVE-2026-54239 | High | 8.8 | 2026-09-17 | Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes th… |
CVE-2026-54586 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fe… |
CVE-2026-54581 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap in… |
CVE-2026-54579 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the… |
CVE-2026-86039 | High | 8.2 | 2026-09-17 | libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses con… |
CVE-2026-86038 | High | 7.5 | 2026-09-17 | libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in package… |
CVE-2026-26950 | High | 8.1 | 2026-09-17 | Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with rem… |
CVE-2026-78296 | Medium | 5.3 | 2026-09-17 | Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing.
This issue affects FluentAuth: from n/… |
CVE-2026-91017 | Low | 3.7 | 2026-09-17 | The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-def… |
CVE-2026-61591 | High | 8.1 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into… |
CVE-2026-88592 | Critical | 9.1 | 2026-09-16 | kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter agai… |
CVE-2026-63127 | High | 8.2 | 2026-09-16 | RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits t… |
CVE-2026-92138 | Medium | 4.2 | 2026-09-16 | The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather… |
CVE-2026-73177 | | | 2026-09-16 | Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-… |
CVE-2026-19941 | Medium | 5.9 | 2026-09-16 | An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream le… |
CVE-2026-92360 | Medium | 6.3 | 2026-09-16 | A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the compone… |
CVE-2026-73435 | High | 8.2 | 2026-09-16 | On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated… |
CVE-2026-77955 | Medium | 4.4 | 2026-09-16 | In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a… |
CVE-2026-84906 | Medium | 5.3 | 2026-09-16 | The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment… |
CVE-2026-85641 | Medium | 4.3 | 2026-09-16 | The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on th… |
CVE-2026-73450 | Medium | 6.9 | 2026-09-16 | On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection net… |
CVE-2026-73437 | Critical | 9.6 | 2026-09-15 | On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access coul… |
CVE-2026-54167 | High | 8.2 | 2026-09-15 | Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHu… |
CVE-2026-88819 | | | 2026-09-14 | In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID. |
CVE-2026-57122 | High | 8.6 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or… |
CVE-2026-89050 | Medium | 4.3 | 2026-09-13 | The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an… |
CVE-2026-54174 | High | 8.3 | 2026-09-11 | melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified… |
CVE-2026-45057 | Medium | 4.9 | 2026-09-11 | matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is miss… |
CVE-2026-89251 | Medium | 6.5 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit… |
CVE-2026-86809 | Medium | 5.3 | 2026-09-11 | The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to… |