CWE-345 vulnerabilities

In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key pair by `CKA_ID`/`CKA_LABEL` and never verify it against the private key. In addition, the "ID only" fallback search runs even when the private key has no `CKA_ID`, so the search template reduces to the public-key class and the ML-KEM key type and the first ML-KEM public key on the token is returned. `Encapsulate()` on the resulting key pair encrypts the fresh shared secret to that key, so its owner — not the holder of the private key the caller looked up — can recover the secret. An attacker who can open an unauthenticated session on the token and plant a public `CKK_ML_KEM` object carrying the victim's `CKA_ID`/`CKA_LABEL` receives the shared secrets for encapsulations performed through the substituted key pair, compromising the confidentiality of those secrets and of everything protected by keys derived from them. The v1 module paths have no ML-KEM support and are not affected.

CVE-2026-103359 is a vulnerability in the PayDunya WooCommerce Payment Gateway WordPress plugin up to version 1.1.6. The plugin fails to verify the authenticity of incoming payment notifications properly, relying on a value derived from an empty secret before the gateway is configured. This flaw allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.

A vulnerability in python-social-auth's social-core prior to version 6.2.0 allows an attacker to bypass nonce validation in OpenIdConnectAuth. The nonce is stored globally rather than being bound to the browser session and OAuth state, enabling an attacker who obtains a victim's unused authorization code to impersonate the victim if DEFAULT_USE_PKCE is disabled. This issue is resolved in version 6.2.0.

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.

CVE-2026-115183 affects the Qi Addons For Elementor WordPress plugin versions prior to 1.11.2. The vulnerability arises from improper sanitization of widget heading text after decoding HTML entities, allowing users with Contributor role or higher to embed live HTML forms, including password fields that submit data to external hosts, in posts where WordPress would normally strip such content.

CVE-2026-115933 is a critical authentication bypass vulnerability in GitroomHQ's postiz-app affecting versions from 2.15.0 up to but not including 2.25.3. The application uses a single shared secret to sign multiple types of tokens (session, invitation, password reset) without distinguishing token purposes. This flaw allows an attacker to craft a valid signed token with arbitrary claims, which the application accepts as legitimate for various sensitive operations including session authentication, organization invitations with chosen roles, password resets, and enterprise provisioning. A narrower related flaw affects team invitation creation. The vulnerability has a CVSS score of 9.9 and is fixed in version 2.25.3.

CVE-2026-115937 is a vulnerability in the Craft CMS commerce-mollie plugin where the Mollie webhook endpoint accepts two attacker-controlled parameters without verifying their association. This allows an unauthenticated attacker to pair any paid Mollie payment ID with any Craft Commerce transaction hash, causing the system to mark the transaction as fully paid regardless of the actual payment amount. The issue affects versions from 2.1.1 up to but not including 4.4.3 and has been fixed in version 4.4.3.

CVE-2026-55459 is an authentication vulnerability in intranda goobi-viewer-core versions from 25.01 up to but not including 26.05. The flaw arises because the application does not properly enforce the 'aud' (audience) claim during JWT token verification, allowing tokens intended for different relying parties to be accepted incorrectly. This can enable an attacker to authenticate as another user. The issue has been fixed in version 26.05.

PraisonAI versions from 4.5.2 up to but not including 4.6.59 contain a vulnerability in the Discord approval backend where any user able to post in the configured approval channel can approve a pending high-risk tool call by sending an approval message such as 'yes'. This occurs because the system does not verify that the approval message is a direct reply or otherwise bound to the approval request, allowing unthreaded channel cross-talk. The issue has been fixed in version 4.6.59.

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.

CVE-2026-114612 is a critical improper privilege management vulnerability in BerriAI's LiteLLM proxy server versions from 1.87.0 up to certain patched releases. The flaw allows an authenticated internal user to forge administrator credentials by exploiting reuse of a cryptographic context for secrets and tokens. This enables escalation to administrative access and execution of arbitrary commands via the MCP stdio endpoint. The issue affects versions 1.87.0 through 1.100.4 and several subsequent minor versions, with fixes released in 1.100.4 and later.

The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.

The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

MobaXterm Personal Edition (Portable) 26.4 GA has a vulnerability where it extracts the CygUtils64.plugin file without verifying its integrity. A local attacker with write permissions to this file can replace the contained 'bin/cygwin1.dll' library with a malicious version. When the victim opens a Local Shell session or uses a Cygwin-based function, the tampered library is loaded and executed with the victim's permissions. This vulnerability requires local write access and does not escalate privileges by itself.

The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.