EUVD-2026-55038

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...

CVE-2026-18030 Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...

You Are Not My Teammate: Behavioral Fingerprint-Based Detection of Suspicious Account Misuse

Online games have been continuously affected by cyber threats such as game bots and gold farming. Game bots, which are automated programs that play on behalf of human users, significantly accelerate character progression and reduce the engagement of legitimate players, potentially leading to user...

PT-2026-69856

Name of the Vulnerable Software and Affected Versions Chatwoot versions prior to 4.9.0 Description Authenticated account administrators can transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts by manipulating the writable account id parameter. This flaw breaks tenant...

PT-2026-69342

Name of the Vulnerable Software and Affected Versions vitepos WordPress plugin versions prior to 3.6.0 Description The point-of-sale password-reset API does not perform a per-target authorization check. Additionally, the custom Outlet Manager role is granted excessive password-reset capabilities ...

PT-2026-69850

Name of the Vulnerable Software and Affected Versions MISP cti-transmute affected versions not specified Description An issue exists where the account following-list endpoint discloses the email addresses of users. When an authenticated user follows another account, the get following function...

PT-2026-69965

Name of the Vulnerable Software and Affected Versions odh-dashboard affected versions not specified Description A flaw exists where the Service Account SA is granted overly broad permissions. An attacker who compromises the dashboard's SA token can exploit these permissions to escalate privileges...

PT-2026-69472

Name of the Vulnerable Software and Affected Versions bluewave-labs/Checkmate versions prior to 2.1.1 Description An unauthenticated remote attacker can determine if a specific email address is registered in the system. This is possible because the 'POST /api/v1/auth/recovery/request' endpoint...

CVE-2026-72719: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

PT-2026-76475

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that get verified user enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

Sign-In Error After Migrating Configuration From MFA-Enabled Server

Challenge After performing Configuration Restore using the Migration mode from a Configuration Backup created by a Veeam Backup & Replication server that had MFA enabled, login attempts using local accounts cause the Veeam Backup & Replication Console to display the error: Unable to sign in: user...

PT-2026-69377

Name of the Vulnerable Software and Affected Versions Block User Account versions prior to 2.0.1 Description The plugin fails to enforce account blocks across all authentication paths. This allows a blocked user who possesses an application password created before the block was applied to maintai...

CVE-2026-18786: Improper Authentication

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

PT-2026-69925

Name of the Vulnerable Software and Affected Versions TBEA TLogger version 2.1.0.0B0.0.0.0 Description A hard-coded or default root account credential allows an unauthenticated remote attacker to gain root-level access to the device through the exposed SSH service. The root password can be...

PT-2026-69959

Name of the Vulnerable Software and Affected Versions Data Science Pipelines affected versions not specified Description An improper authorization issue exists in the setDefaultServiceAccount function. A restricted user or tenant can bypass authorization checks by specifying a more privileged...

CVE-2026-14237: Improper Privilege Management

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to res...

PT-2026-76485

Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...

CVE-2026-72917: Incorrect Behavior Order: Validate Before Canonicalize

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

PT-2026-69986

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.0.0 through 1.15.0 Description The unauthenticated account-recovery flow in the server/utils/PasswordRecovery/index.js file uses the recoverAccount function to deduplicate recoveryCodes values before they are trimmed. Th...

PT-2026-69368

Name of the Vulnerable Software and Affected Versions BricksForge WordPress plugin versions prior to 3.1.8.8 Description An issue exists where the plugin fails to verify the identity of the requester during a password change submitted via a form action. This allows unauthenticated attackers to se...