CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...

CVE-2026-60961

creationtimestamp| type| source ---|---|--- 2026-08-19 17:15:56+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-60969

creationtimestamp| type| source ---|---|--- 2026-08-19 17:15:17+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-70770

creationtimestamp| type| source ---|---|--- 2026-08-19 16:52:48+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-28 10:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu566dyir62c...

CVE-2026-70696

creationtimestamp| type| source ---|---|--- 2026-08-19 16:51:40+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-70807

creationtimestamp| type| source ---|---|--- 2026-08-19 16:51:04+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-70806

creationtimestamp| type| source ---|---|--- 2026-08-19 16:51:01+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-70820

creationtimestamp| type| source ---|---|--- 2026-08-19 16:50:12+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

Missing Critical Step in Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the remember-me process. An attacker can gain full authenticated access without completing second-factor...

CVE-2026-71016

creationtimestamp| type| source ---|---|--- 2026-08-19 16:49:22+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-28 21:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu6beutwf32f...

CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

Overview On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The vulnerability carries a CVSS v4.0 base score of 9.3 and can be exploited remotely by an unauthenticated...

CVE-2026-70777

creationtimestamp| type| source ---|---|--- 2026-08-19 16:45:14+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-20317 Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Authentication Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-62669

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-44255 Wazuh: Username Enumeration via Timing Side-Channel

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.checkuser in framework/wazuh/rbac/orm.py performs checkpasswordhash only when the supplied username exists. A nonexistent username returns...

CVE-2026-62667

CVE-2026-62667 affects the Grav API Plugin (a RESTful API for Grav CMS) prior to version 1.0.6 . The root cause is an authorization bypass : ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() never reads or enforces it, returning the owning user's...

CVE-2026-62669 Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-62669

Grav Login Plugin (for Grav CMS) prior to 3.8.11 contains a two-factor authentication bypass in the login.regenerate2FASecret task. The root cause is an insufficient authorization check: the task verifies only that the pending-session user exists rather than requiring $user->authorized. An att...

CVE-2026-71960

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...

CVE-2026-50149

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...