CVE-2026-84905 Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploadin...

EUVD-2026-80173

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-92358 Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-92358

Keycloak 's first broker login flow contains a flaw where a temporary proof created during a cross-browser account-linking request is not properly cleared after the link is established or manually removed. An attacker who controls the external identity can exploit this residual proof to silently ...

CVE-2026-92358 Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-92358

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 CVSS score: 9.8/10.0, is a case of improper verification of a cryptographic signature that could result in account takeove...

CVE-2026-12793

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

EUVD-2026-80097

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

CVE-2026-14349

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.3 . The root cause is a missing permission check on the admin_addcustomer AJAX action in main/function_ajax.php, allowing unauthenticated at...

CVE-2026-83103

creationtimestamp| type| source ---|---|--- 2026-09-16 00:13:04+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlu5yc23725 2026-09-16 01:00:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlws6nrfs2g 2026-09-23 09:46:49+00:00| seen|...

CVE-2026-84905: Missing Authorization

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploadin...

CVE-2026-82310: Insufficient Session Expiration

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

PT-2026-93339

An unauthenticated remote attacker can exploit an authentication bypass in the account log function to log in as an admin, even when accounts are properly configured...

PT-2026-93317

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

PT-2026-93267

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

CVE-2026-89029: Authorization Bypass Through User-Controlled Key

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller ...

CVE-2026-87031: Missing Authorization

n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint POST /ccm/api/1.0/users, the add method of concrete/src/Api/Controller/Users.php did not perform a permission check before creating an account. As a result, any valid OAuth token carrying the users:add scope, including a...

CVE-2026-92716: Authorization Bypass Through User-Controlled Key

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary us...