CVE-2026-123802 is an improper authentication vulnerability in SuperTokens Core affecting versions from 11.3.0 up to but not including 11.3.8, 11.4.0 up to 11.4.8, 12.0.0 up to 12.0.11, 12.1.0 up to 12.1.2, 12.2.0 up to 12.2.1, and 12.3.0 up to 12.3.1. The flaw allows a licensed deployment with a configured SAML client to authenticate an identity from an assertion that does not satisfy the audience check properly, enabling an attacker to impersonate a victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.
This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.
We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.
The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0.
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only to the user's identifier, while UpdateUser can change the account email without invalidating the outstanding token and VerifyEmail marks the current address as verified. An ordinary user can request a token for an address they control, change the account to an arbitrary unused address, and redeem the old token so Pocket ID publishes the new address with email_verified set to true. The default affected configuration uses emailsVerified=false and allowOwnAccountEdit=true; the target address must not already belong to another Pocket ID user. A relying application that trusts a verified email for automatic account matching or provisioning can link the attacker's identity to another user's account, while applications that rely exclusively on the stable OIDC sub claim are not affected by that downstream consequence. This issue is fixed in version 2.12.0.
An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that can reach the embedded document can inject fabricated fields or records, spoof pending ui/initialize responses, disrupt the MCP UI handshake, or receive outbound messages when the resource is embedded by an untrusted parent. Values are HTML escaped, so the demonstrated content injection is display spoofing rather than script execution, and exploitability depends on the host embedding model. This issue is fixed in version 0.4.112.
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.
The PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5 have a vulnerability where payment notifications are not verified for authenticity if the merchant secret is unset, which is the default configuration. This flaw allows unauthenticated attackers to forge payment confirmations and mark orders as paid without actual payment.
CVE-2026-63115 is an authentication bypass vulnerability in TryGhost's ActivityPub server versions 1.0.0 through 1.2.5. The flaw allows a remote federated server to spoof activities in the Undo handler, causing the service to act on follow or repost actions as if they originated from a different account. This can remove existing follow relationships or reposts without the account owner's involvement. No private data is exposed, and content is not altered. The issue is fixed in version 1.2.6.
Zuke-build versions prior to 1.10.0 have a vulnerability in the @zuke/gh githubWorkflow(...) gate where it insufficiently verifies the authenticity of dispatched workflow runs. The gate relies only on a display-title marker that can be spoofed by an attacker with workflow_dispatch permission in an external repository. This allows the attacker to substitute a workflow run conclusion, potentially authorizing unvalidated releases or blocking valid ones. The issue is fixed in version 1.10.0.
CVE-2026-110985 is a critical vulnerability in Apache Kafka brokers using SASL/OAUTHBEARER authentication with the default JWT validator configuration. If the sasl.oauthbearer.jwks.endpoint.url is not set and no custom verification key resolver is configured, the broker falls back to a validator that does not verify JWT signatures, algorithms, or issuers. This allows unauthenticated remote attackers to forge tokens with any principal, including superusers, gaining full cluster access. The issue affects specific Kafka versions prior to fixed releases. From Kafka 4.2.2, 4.3.1, and 4.4.0 onward, brokers fail to start if misconfigured, preventing insecure operation.
Apache Kafka brokers using SASL/OAUTHBEARER with the bundled JWKS-backed validator verify JWT signatures but do not enforce issuer and audience claim checks by default. This can allow tokens from different issuers or tokens lacking audience claims to authenticate if the JWKS endpoint serves keys for multiple issuers. From version 4.4.0, Kafka requires explicit configuration of issuer and audience checks or allows opting out. Versions from 3.1.0 up to but not including 4.4.0 are affected if these settings are not configured.
CVE-2026-103402 is a high-severity vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor. It involves insufficient verification of data authenticity in the PCLI component, allowing an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges. The vulnerability affects versions prior to 7.0.5, versions from 7.1.0 up to but not including 7.1.7, and versions from 7.2.0 up to but not including 7.2.3. Fixed versions are 7.0.5, 7.1.7, and 7.2.3. No known exploits in the wild have been reported.
The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.
A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.