CVE-2026-68945

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Angular

Products

Angular Common

CVE-2026-10754

Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.

Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Pegasystems

Products

Pega Infinity

CVE-2026-59112

Signature validation vulnerability affecting DigiDoc applications

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.

CVSS 4.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Estonian Information System Authority (ria)

Products

Digidoc Digidoc4 Libdigidocpp

CVE-2026-16742

systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Systemd

Products

Systemd

CVE-2026-19418

TYPO3 CMS - Broken Access Control in Backend and Install Tool

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Typo3

CVE-2026-46409

OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server — the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with `permission_presets.bash=true`, shut down the service, and exfiltrate chat history and account PII — with no user interaction beyond opening the page. Version 1.1.3 patches the issue.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Openyak

Products

Openyak

CVE-2026-47664

Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Aehrc

Products

Pathling

CVE-2026-11361

Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Formidableforms Wordpress

Products

Formidable Wordpress

CVE-2026-14936

Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Simple-membership-plugin Wordpress

Products

Simple Membership Wordpress

CVE-2026-15239

Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Simple Captcha Wordpress

Products

Simple Captcha With Cloudflare Turnstile Wordpress

CVE-2026-15211

Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpswings

Products

Wordpress Subscriptions For Woocommerce

CVE-2026-15148

WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp-eventmanager

Products

Wordpress Wp Event Manager

CVE-2026-15208

RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Registrationmagic Wordpress

Products

Registrationmagic Wordpress

CVE-2026-15152

WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Hotel Booking

Products

Wordpress Wp Hotel Booking

CVE-2026-19127

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal (LTD) redemption codes, an unauthenticated attacker can forge valid redemption tokens or replay existing single-use codes to activate permanent, tier-highest paid subscriptions without a financial transaction.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gitroomhq

Products

Postiz-app

CVE-2026-50634

Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Cxf

CVE-2026-11836

Production Debug-Unlock Token Verification Missing Device Binding

Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed

Vendors

Caliptra

Products

Core Firmware Core Rom

CVE-2026-15587

Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header

Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header. This vulnerability was patched with version 6.3.85, and no customer action is needed.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Google Cloud

Products

Google Secops (chronicle Soar)

CVE-2026-16442

Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak Data Grid 8 and 5 more

CVE-2026-66732

Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Eukaryot

Products

Sonic3air