CVE-2026-66785 is a vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.16 involving Submariner, a Kubernetes operator for cross-cluster connectivity. A malicious spoke cluster can publish crafted network endpoints with arbitrary network subnets, causing network traffic from peer clusters to be redirected through the attacker's tunnel. This improper validation of network subnets can lead to unauthorized information disclosure or network disruption. Red Hat has released fixes in version 2.17 and Submariner v0.24 to address this issue.
CVE-2026-53425 is a vulnerability in Dropbox's samly library that causes insufficient verification of data authenticity in SAML responses. The vulnerability allows an attacker to establish an authenticated session using a SAML response that the service provider never requested. This occurs because the library does not verify the InResponseTo attribute in the SAML response against the original AuthnRequest ID, violating SAML 2.0 Core requirements. Exploitation requires a valid signed assertion from the trusted IdP and a RelayState matching the victim's session.
CVE-2026-44725 is a vulnerability in EMQX MQTT broker prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1. The plugin-install REST API and dashboard upload accepted stale grants without enforcing a five-minute grant lifetime or SHA-256 package binding. An attacker with compromised dashboard administrator credentials or an API key with plugin-install permission could exploit this to upload and execute malicious Erlang code with EMQX process privileges.
Coturn versions prior to 4.15.0 have a vulnerability where an on-path attacker can append attributes after the MESSAGE-INTEGRITY attribute in an authenticated STUN request over plain UDP or TCP. This allows modification of the STUN header length and recomputation of the unkeyed FINGERPRINT while the original HMAC remains valid, enabling server-side parsing to process malicious trailing attributes. These trailing attributes can override allocation lifetime, inject permissions, or bypass origin checks. Deployments using TLS or DTLS are not affected by this issue. The vulnerability is fixed in version 4.15.0.
ZcashFoundation's Zebra node prior to version 4.5.0 is vulnerable to a denial-of-service condition caused by insufficient verification of data authenticity from unauthenticated P2P peers. A malicious peer can respond to block requests with a small inventory and then serve a syntactically valid block with an artificially high coinbase height, triggering a sync restart delay of 67 seconds on mainnet. This can be repeated indefinitely, significantly degrading synchronization performance without corrupting the node's state. The issue is fixed in Zebra versions 4.5.0 and later.
BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.
CVE-2026-18674 is a vulnerability in Kong Inc.'s Kong Mesh affecting specific versions where the global control plane incorrectly attributes resources received over the zone-to-global KDS sync using a sender-controlled identifier rather than the authenticated zone identity. This flaw allows an authenticated zone to inject, attribute, and overwrite resources in another zone's namespace, resulting in a cross-zone isolation bypass.
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim's distinct query. This issue is fixed in version 0.4.112.
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses `prisma.taskRun.findUnique({ where: { friendlyId: runParam } })` without a runtimeEnvironmentId filter, then ReplayTaskRunService in apps/webapp/app/v3/services/replayTaskRun.server.ts replays the selected run in the victim environment. Any valid environment API key can therefore replay another tenant's run by friendlyId, consuming victim resources and repeating side effects; when `payloadType: "application/store"` is used, overrideExistingPayloadPacket() calls conditionallyImportPacket() on existingTaskRun.payload without an integrity check, so payload bytes overwritten through a separate object-store path-traversal vulnerability become attacker-controlled input to the victim task. This issue is fixed in version 4.5.0-rc.4.
NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.
An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation.
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.
CVE-2026-21078 is a medium severity vulnerability in Samsung Mobile Smart Switch prior to version 3.7.72.6. It involves insufficient verification of data authenticity in the trouble scanning mode, which allows adjacent attackers to spoof device identity. No patch or official remediation has been confirmed yet. There are no known exploits in the wild at this time.