PaperCut NG/MF Critical Zero-Day Exploited in the Wild

Overview On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the...

CVE-2026-81777 WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

EUVD-2026-67656

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

CVE-2026-81777

Essential Addons for Elementor (WordPress plugin by WPDeveloper) versions up to and including 6.8.0 are affected by an Authentication Bypass by Spoofing vulnerability that enables Identity Spoofing . The issue was discovered by Gaurav popalghat and scored CVSS 5.3 (MEDIUM) , with a network attack...

CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2026-76581

CVE-2026-76581 is a Critical (CVSS 9.8) unauthenticated Authentication Bypass in the WPMU DEV Dashboard plugin for WordPress (≤ 5.0.1 , ~350,000 installs). The root cause is HMAC canonicalization confusion between two unauthenticated AJAX actions: wdpsso_step1 signs an unseparated concatenation o...

CVE-2026-76581 WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

EUVD-2026-67464

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2026-41940

CVE-2026-41940 — cPanel2Shell Interaktives Ausnutzungstool für CVE-2026-41940 🧠 Was ist CVE-2026-41940 ? cPanel2Shell nutzt eine kritische Schwachstelle zur Authentifizierungsumgehung in cPanel & WHM aus. Die Schwachstelle wird durch eine CRLF-Injection im Login-/Session-Handling-Mechanismus...

EUVD-2026-67289

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

EUVD-2026-67282

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

CVE-2026-76945

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

CVE-2026-76943

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

CVE-2026-71187

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

PT-2026-83066

Name of the Vulnerable Software and Affected Versions Dovecot affected versions not specified Description Information forwarded from a host configured as a trusted proxy is not properly isolated from internal authentication fields. This allows a trusted proxy to inject values into internal...

PaperCut NG < 24.1.9.76516 / 25.x < 25.0.12.76510 / 26.x < 26.0.4.76508 Multiple Vulnerabilities

The version of PaperCut NG installed on the remote Windows host is prior to 24.1.9.76516 or 25.x prior to 25.0.12.76510, or 26.x prior to 26.0.4.76508. It is, therefore, affected by the following vulnerabilities: - An authentication bypass vulnerability exists in the web management interface due ...

PaperCut MF < 24.1.9.76515 / 25.x < 25.0.12.76509 / 26.x < 26.0.4.76507 Multiple Vulnerabilities

The version of PaperCut MF installed on the remote Windows host is prior to 24.1.9.76515 or 25.x prior to 25.0.12.76509, or 26.x prior to 26.0.4.76507. It is, therefore, affected by the following vulnerabilities: - An authentication bypass vulnerability exists in the web management interface due ...

PT-2026-83289

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin api require auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...

PT-2026-83074

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.5-1.1 Description An authentication flaw exists where a token intended for a different purpose can be used to authenticate. This occurs when an OAuth2 token response lacks a scope claim, causing the system to use...