181551 matches found
SUSE CVE-2026-85596
Traefik versions = v3.7.0 and = v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress...
CVE-2026-52767
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature checks the result of PHP's opensslverify with a loose boolean negation - if !opensslverify... throw ... . PHP's opensslverify has four possible return values: 1, 0, -1, and...
PT-2026-86308
Name of the Vulnerable Software and Affected Versions Mstore Api plugin for WordPress versions prior to 4.20.1 Description An authentication bypass exists due to JWT JSON Web Token forgery. The issue occurs in the FirebasePhoneAuthHelper::verify id token function, which validates token claims suc...
PT-2026-86409
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP ENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered ema...
PT-2026-86352
šØ CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and dele...
PT-2026-86354
šØ CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting...
PT-2026-86334
šØ CVE-2026-78362 The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take ov...
AlmaLinux 10 : buildah (ALSA-2026:63332)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:63332 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 net/mail: golang: net/mail...
PT-2026-86448
šØ CVE-2026-86207 - critical šØ N-able N-central - Authentication Bypass An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in... š¾ https://t.co/BDWCBNCGsg @pdnuclei NucleiTemplates cve...
PT-2026-86336
šØ CVE-2026-81348 The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory...
PT-2026-86454
Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2 Description An issue exists where the SSH server enters the connection protocol following a client-requested rekey without requiring user...
AlmaLinux 10 : freerdp (ALSA-2026:61378)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61378 advisory. FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses CVE-2026-67297 FreeRDP: FreeRDP: Memory disclosure or denial of service vi...
CVE-2026-52767 YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature checks the result of PHP's opensslverify with a loose boolean negation - if !opensslverify... throw ... . PHP's opensslverify has four possible return values: 1, 0, -1, and...
CVE-2026-52767 YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature checks the result of PHP's opensslverify with a loose boolean negation - if !opensslverify... throw ... . PHP's opensslverify has four possible return values: 1, 0, -1, and...
CVE-2026-52767
YesWiki versions 4.6.2 through 4.6.5 are affected by a signature-verification bypass in the ActivityPub implementation. The vulnerable function HttpSignatureService::verifySignature() in tools/bazar/services/HttpSignatureService.php uses a loose boolean negation on PHP's openssl_verify(). When op...
AZL-99693 CVE-2026-86091 affecting package ntopng 5.2.1-6
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
CVE-2026-46636
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a...
CVE-2026-86090
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-46636
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a...
CVE-2026-46636
Twig , a PHP template language, is affected in versions 1.0.0 through 3.27.0 . The vulnerability stems from SecurityPolicy::checkMethodAllowed() unconditionally whitelisting all method calls on Twig\Markup instances. Because Twig\Markup is not final, subclasses inherit this bypass, exposing every...