CVE-2026-19941

checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof

An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Isc

Products

Bind

CVE-2026-91017

Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-85008

undici vulnerable to caching and replay of unsafe HTTP method responses

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then have the client's own subsequent state-changing requests to that path served from the stale cache entry without ever reaching the origin, an integrity failure that occurs under the interceptor's default configuration. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Nodejs Undici

Products

Undici Undici

CVE-2026-88819

Refresh Token Handler Lacks Proof of Possession of Issuer DID in Siglet

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-57122

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the webhook route can forge messages, comments, or agent-session events, impersonate platform users, influence agent prompts and actions, and disrupt bot processing. This issue is fixed in 4.6.59.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mervinpraison

Products

Praisonai

CVE-2026-89050

Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-54174

melange: Incomplete package integrity verification allows data section substitution

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Chainguard-dev

Products

Apko Melange

CVE-2026-45057

matrix-sdk-ui: Incomplete edit validation

matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user. `matrix-sdk-ui` 0.17.0 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification. No known workarounds are available.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Matrix-org

Products

Matrix-sdk-ui

CVE-2026-73316

XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Xenforo

Products

Xenforo

CVE-2026-89251

AVideo Missing Authorization via AD_Server log.php Wallet Credit

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests to mint YPTWallet balance for any campaign video without proof an ad actually played.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-69105

Potential package cache integrity issue in JFrog Artifactory

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-76245

stigmem Federation Peer Token Timestamp Validation Bypass

stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using federation peer authentication paths. The issue is fixed in 0.9.0a2, which uses the canonical millisecond-based validation path.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Eidetic-labs

Products

Stigmem

CVE-2026-33243

barebox: FIT Signature Verification Bypass Vulnerability

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Barebox Pengutronix

Products

Barebox Barebox

CVE-2026-73419

NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Nextauth.js

Products

Core Next-auth

CVE-2026-80172

Unauthenticated Replay Attack Enables Remote Admin Access

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This vulnerability is considered critical as an unauthenticated attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens. Since there is no nonce validation or time limit on requests, the attack can be performed indefinitely. Dell recommends customers to upgrade at the earliest opportunity

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-83537

WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-53728

Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to that attacker-supplied URL and issues a redirect. Because the external login request state is serialized as raw JSON and later trusted by the callback, an attacker who can tamper with state.redirectUri can cause Medplum to redirect authorization artifacts to an attacker-controlled endpoint. When the registered redirect URI is a bare origin or another prefix that can be extended into a different hostname, this becomes a cross-origin authorization code leak. This issue has been patched in version 5.1.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Medplum

Products

Medplum

CVE-2026-20355

Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Secure Email

CVE-2023-20576

hw: amd: Insufficient Verification of Data Authenticity in AGESATM

Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-84767

WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Bookit Wordpress