CVE-2026-86709

The Pressengine WordPress plugin (versions

CVE-2026-86709 The Pressengine <= 1.0 - Unauthenticated Authentication Bypass

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-86710 Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

PT-2026-94236

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit c3edcc274c389816d434acadac07ee78eaf330c1 Description The software uses a cryptographically weak pseudo-random number generator to create account activation and login pairing codes. The getRandomCode function in...

CVE-2026-86709: Improper Authentication

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-90174: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbdallocuser ksmbdallocuser copies resp-hashsz bytes out of the mountd IPC login response with user-passkeysz = resp-hashsz; user-passkey = kmallocresp-hashsz, KSMBDDEFAULTGFP; if...

PT-2026-94522

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-out-of-bounds read exists in the ksmbd alloc user function. The issue occurs because the function uses the hash sz variable, provided by a mountd IPC login response, to determine...

PT-2026-94165

Name of the Vulnerable Software and Affected Versions Login with QR versions prior to 1.0.1 Description The Login with QR WordPress plugin fails to verify if the authentication code used for login was actually issued by the system. Instead, it matches the code against any stored user metadata...

PT-2026-105026

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame max value during amqp login, and rabbitmq-c accepts the value in amqp login inner in librabbitmq/amqp socket.c. amqp tune connection in librabbitmq/am...

PT-2026-95044

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...

CVE-2026-90413: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares...

PT-2026-94164

Name of the Vulnerable Software and Affected Versions Pressengine WordPress plugin versions prior to 1.1 Description The login handler fails to prevent the issuance of a session when authentication fails. This allows unauthenticated attackers to bypass authentication and log in as any user,...

CVE-2026-86710: Improper Authentication

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

CVE-2026-86707: Improper Authentication

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

PT-2026-94523

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the SMB server component of the Linux kernel. The issue arises when the buffer returned by the ksmbd ipc login request ext function is not properly freed after...

PT-2026-94641

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IB/isert component where isert put login tx posts full-feature receive buffers before transport register session is executed. This allows an initiator that does no...

SUSE SLED15 / SLES15 Security Update : kbd (SUSE-SU-2026:4211-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4211-1 advisory. This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect...

Linux Distros Unpatched Vulnerability : CVE-2026-19607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a...

SUSE SLES15 Security Update : kbd (SUSE-SU-2026:4207-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4207-1 advisory. This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner...

CVE-2026-19607

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...