CVE-2026-86710

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

CVE-2026-86709

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-86710

The Login with QR WordPress plugin (versions

CVE-2026-61594

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization —...

CVE-2026-61594 djust has an authorization bypass on the WebSocket/SSE mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization —...

CVE-2026-61594

djust is a Phoenix LiveView-style reactive server-side rendering library for Django with Rust-powered performance. Prior to version 1.0.7 , its live WebSocket transport authorized view mounts via check_view_auth rather than Django's View.dispatch() chain. This caused standard Django authorization...

CVE-2026-61594 djust has an authorization bypass on the WebSocket/SSE mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization —...

GHSA-XHHM-F6HP-2QWJ djust has an authorization bypass on the WebSocket/SSE mount path

Impact The live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @methoddecoratorloginrequired, name="dispatch", and custom dispatch guards — a...

CVE-2026-76423

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit...

CVE-2026-20344 Cisco Secure Firewall Management Center Software SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of...

CVE-2026-76423 Cisco ISE API Authentication Bypass Vulnerability

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit...

Principal-HackTheBox

HackTheBox — Principal Dificultad: Media SO: Linux Plataforma: HackTheBox Resumen Aplicación web que ejecuta pac4j-jwt v6.0.3 — vulnerable a CVE-2026-29000. La clave pública RSA está expuesta sin autenticación a través de un endpoint JWKS y puede usarse para forjar un token JWE de administrador...

CVE-2026-76677

A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticated user to achieve administrative privilege on the web-management interface leading to complete system compromise...

CVE-2026-76673 Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator

Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete...

CVE-2026-73465

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-73466

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

CVE-2026-73465

CVE-2026-73465 is a CWE-532 (Insertion of Sensitive Information into Log File) vulnerability in Arista EOS . When MgmtSecuritySslCertKey trace levels 0, 3, and/or 4 are enabled on the ConfigAgent agent, plaintext RSA and EC private keys may be written to /var/log/agents/ConfigAgent-* log files. E...

CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext private keys

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-91930

Flowise versions prior to 3.1.4 contain an insufficient tenant isolation flaw in the enterprise organizationuser and workspace endpoints. The APIs fail to scope membership operations to the caller's tenant, allowing an authenticated user to supply an arbitrary organization ID . This enables an at...