CVE-2026-76581: Improper Verification of Cryptographic Signature

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

On August 19th, 2026, during internal research, I discovered an Authentication Bypass vulnerability in WPMU DEV Dashboard, a WordPress plugin with an estimated 350,000 active installations. This vulnerability makes it possible for unauthenticated attackers to gain administrator access when Hub...

SUSE CVE-2026-76844

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

CLSA-2026-1787837620 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.15.2-tuxcare.3...

CLSA-2026-1787837465 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.11.1-tuxcare.4...

CVE-2026-76844

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...

CLSA-2026-1787828309 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.7.3-tuxcare.6...

CLSA-2026-1787823957 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.11.1-tuxcare.3...

CLSA-2026-1787821986 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.11.5-tuxcare.4...

PT-2026-82837

Name of the Vulnerable Software and Affected Versions WPMU DEV Dashboard versions prior to 5.0.2 Description An authentication bypass exists in the Hub Single Sign-On SSO flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a...

PT-2026-86548

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.7.3-tuxcare.6...

PT-2026-86552

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.11.1-tuxcare.4...

PT-2026-86547

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.11.1-tuxcare.3...

VulnCheck KEV: CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

PT-2026-86553

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.15.2-tuxcare.3...

PT-2026-96865

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.11.5-tuxcare.4...

Linux Distros Unpatched Vulnerability : CVE-2026-76844

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at...

@objectstack/cli (>=15.0.0, <=17.0.0), @objectstack/cloud-connection (>=15.1.1, <=17.0.0) +6 more potentially affected by CVE-2026-80192 via @better-auth/sso (>=1.7.0-rc.1, <=1.7.0-rc.2)

@better-auth/sso NPM version =1.7.0-rc.1, =15.0.0, =15.1.1, =15.0.0, =15.1.1, =15.0.0, =15.1.1, =17.0.0-rc.4, =15.1.1, =17.0.0 Source cves: CVE-2026-80192 Source advisory: SNYK:JS-BETTERAUTHSSO-19267832...

CVE-2026-74736: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: reject dev-bound programs bound to a different device clsbpfprogfromefd obtained a SCHEDCLS program via bpfproggettypedev but never verified that a device-bound offloaded program's bound netdev matches the TC...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098938)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098938 advisory. In the Linux kernel, the following vulnerability has been resolved: net: use dstdevrcu in sksetupcaps Use RCU to protect accesses to dst-dev from sksetupcaps and...