PyJWT versions prior to 2.14.0 contain a vulnerability in the PyJWKClient component where HTTP redirects during JWKS fetching are followed without validating the redirect destination. This can lead to exposure of sensitive request headers and allow an attacker-influenced redirect to poison JWKS trust, potentially causing acceptance of forged JWTs. The issue requires an attacker to influence the configured JWKS endpoint's response and is not triggered by token key IDs alone. The vulnerability is fixed in PyJWT 2.14.0.
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.
FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through provideTrustedEmail(). When Discord sign-in is enabled, an unauthenticated attacker who knows the email address of a Flarum user can configure a Discord account with that unverified address and a verified phone number, then sign in to cause Flarum to match the trusted address, link the attacker-controlled Discord identity to the existing user, and authenticate as the victim without a password or victim interaction. Exploitation requires that the victim's email address is not already associated with a Discord account, and it can compromise administrator accounts. Other bundled providers were not confirmed to be practically exploitable by this method because their relevant authentication flows return only verified or confirmed email addresses. This issue is fixed in versions 1.7.4 and 2.0.0-beta.4.
The Botslab G980H dash camera firmware has a critical vulnerability due to insufficient verification of firmware update authenticity. The device retrieves firmware updates over an unprotected connection and relies on an integrity value provided with the firmware rather than a trusted cryptographic signature. This flaw allows an attacker positioned to intercept the firmware download or an authenticated attacker submitting a crafted update to install modified firmware and execute unauthorized code on the device.
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. The SAML Source also does not record already accepted assertions, allowing replay. An unauthenticated actor who possesses such a valid assertion can use an assertion intended for another service provider or reuse an earlier assertion to authenticate as the user named by the assertion. Only SAML Sources are affected; SAML Providers and other Source types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.
CVE-2026-94455 is a vulnerability in GitroomHQ's postiz-app allowing unauthenticated creation of enterprise organizations with elevated privileges. The affected HTTP endpoint lacks proper authentication checks, relying solely on a token signed with the instance secret but not verifying token purpose or expiry. This flaw permits an attacker with a valid user session token to create a new organization with the highest subscription tier and obtain its API key, which is immediately valid for API access.
Joplin Desktop for Windows versions prior to 3.7.2 have a vulnerability where the update mechanism does not properly verify the authenticity of update packages. This allows an attacker controlling the update delivery path to replace update metadata and installers with malicious versions that may be unsigned or signed by an unauthorized publisher. Exploitation can lead to execution of attacker-controlled code with the user's privileges, risking compromise of notes, credentials, and local data. The issue is fixed in version 3.7.2.
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
CVE-2026-62874 is a critical vulnerability in Microsoft Azure Billing involving insufficient verification of data authenticity. This flaw allows an unauthorized attacker to elevate privileges over a network, potentially leading to complete compromise of confidentiality and integrity, with limited impact on availability. The vulnerability affects the Azure Billing cloud service. An official fix is available from Microsoft.
CVE-2026-54608 is a vulnerability in MythicalLTD's MythicalDash (version 3.5.4-aurora and earlier) involving insufficient verification of data authenticity in the Stripe payment processing API. The flaw allows authenticated users to exploit the payment process by submitting a pending payment code without actual payment confirmation, resulting in free virtual currency top-ups. This leads to direct financial loss through unauthorized consumption of hosting resources. No fixed version is currently available.
CVE-2026-54239 is a high-severity vulnerability in the FaustWP WordPress plugin, part of the Faust.js headless WordPress toolkit. Versions prior to 1.8.11 improperly authenticate token data by excluding the initialization vector from the HMAC, allowing a logged-in non-administrator to manipulate tokens. This manipulation can escalate privileges to administrator level, enabling full REST API access, administrator account creation, plugin installation, and arbitrary code execution. The issue is fixed in version 1.8.11.
mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof visible ICMP replies could influence mirror latency selection, while a malformed packet carrying IP options could shift the ICMP header and trigger an out-of-bounds read. This issue is fixed in version 2.7.8.
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror able to alter bootstrap index content or its transport path could therefore cause mport to proceed with an unverified or tampered bootstrap package index. This issue is fixed in version 2.7.8.
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.