EUVD-2026-51934

The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...

EUVD-2026-51933

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

EUVD-2026-51927

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper...

CVE-2026-18573 Keycloak-services: keycloak-services: client access-type policy condition bypass during client update

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper...

CVE-2026-18573

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper...

CVE-2026-18573

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper...

[SECURITY] Fedora 44 Update: curl-8.18.0-8.fc44

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

CVE-2026-8457

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple idtoken and decoding only its base64 payload without verifying the JWT signature against Apple'...

Linux Distros Unpatched Vulnerability : CVE-2026-67294

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In...

PT-2026-67139

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2026.3.2 Description An incomplete patch allows for authentication bypass and account takeover. This issue occurs when an attacker uses an alternate path or channel to bypass the authentication mechanism...

PT-2026-67138

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the keycloak-services component, used for managing authentication and authorization flows, allows a bypass of client access-type policy conditions. When a realm administrator...

Weechat -- Multiple vulnerabilities

The Weechat project reports: core: fix buffer overflow in display of time in chat area with a custom time format core: fix integer overflow in size calculation when evaluating "$hide:..." and "$baseencode:..." core: fix possible buffer overflow in command /color alias core: fix possible buffer...

VulnCheck KEV: CVE-2026-18577

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1...

CVE-2026-8457

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple idtoken and decoding only its base64 payload without verifying the JWT signature against Apple'...

CVE-2026-8457 WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple idtoken and decoding only its base64 payload without verifying the JWT signature against Apple'...

CVE-2026-8457

The CVE affects the WooCommerce – Social Login plugin for WordPress up to version 2.8.7. Root cause: the Apple login handler decodes the id_token payload without validating the JWT signature against Apple’s public keys and without verifying issuer, audience, or expiry, combined with a publicly ex...

CVE-2026-18556

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1...

EUVD-2026-51918

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1...

CVE-2026-18556

Summary of findings : CVE-2026-18556 is an authentication bypass in N-able N-central (through 2026.1), later followed by CVE-2026-18577 describing an incomplete patch that enables the same class of vulnerability. Attacks reportedly gained remote admin access and, via Take Control, reached custome...

CVE-2026-18556 Unauthenticated administrative account takeover

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1...