CVE-2026-86405

CriticalCVSS 9.8/10Last modified Oct 12, 2026

Description

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation.

This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-864067.5The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, an CVE-2026-864073.7The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation pa CVE-2026-864086.5Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view()CVE-2026-864098.1Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent tran CVE-2026-864108.1A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, an CVE-2026-864119.1An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `CVE-2026-864128.1A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using CVE-2026-864139.1When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its creden CVE-2026-864149.1An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, CVE-2026-864157.5libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schann CVE-2026-864165.4ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and CVE-2026-864174.3Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetc