CVE-2026-53952

GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) are affected by a logic flaw that allows unauthenticated attackers to create a new administrator account . The root cause is a self-exclusion bug in the post-installation deletion logic for admin/setup.php, which fails to r...

CVE-2026-53952 GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS v3.4.0a and below and GetSimpleCMS-CE v3.3.22 and below allows unauthenticated attackers to create a new administrator account. The application features an...

CVE-2026-53952 GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS v3.4.0a and below and GetSimpleCMS-CE v3.3.22 and below allows unauthenticated attackers to create a new administrator account. The application features an...

CVE-2026-54694 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

CVE-2026-68484

Cash Collect by Sage contains an improper authorization vulnerability in the Sage AR Automation API . Administrative functions fail to properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and escalate to elevated privileges. The issue is ra...

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Overview While conducting research into a recent N-able N-central authentication bypass vulnerability CVE-2026-18577, Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker ...

CVE-2026-86195

grav-plugin-api versions 1.0.0 through 1.0.19 contain a privilege escalation vulnerability in the InvitationsController . The stripSuperFlags() method removes nested super flags but fails to strip dot-keyed equivalents such as api.super . A non-super user with api.access and api.users.write permi...

CVE-2026-86195 grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...

EUVD-2026-71997

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...

CVE-2026-66842

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface TMUI. Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP manageme...

CVE-2026-66842

CVE-2026-66842 affects F5 BIG-IP (all modules) and BIG-IQ Centralized Management , allowing any authenticated user to create administrative accounts via an undisclosed request to the Configuration utility (TMUI) . F5 classified the root cause as CWE-918 (Server-Side Request Forgery) . The vulnera...

PT-2026-84761

Name of the Vulnerable Software and Affected Versions BIG-IP affected versions not specified BIG-IQ affected versions not specified Description An authenticated user with any role can escalate privileges by creating administrative user accounts. This is achieved through an undisclosed request sen...

F5 Networks BIG-IP : BIG-IP and BIG-IQ Configuration utility vulnerability (K000162521)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.4 / 17.5.1.8 / 21.0.0.3 / 21.1.0.1. It is, therefore, affected by a vulnerability as referenced in the K000162521 advisory. BIG-IP has a vulnerability where an authenticated user of any role may be able to create...

CVE-2026-19806

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

CVE-2026-38577

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

CVE-2026-38577

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

CVE-2026-38577

Tenda HG21 router (version V4.0.0-260302 ) contains insecure hardcoded credentials in its Admin account, allowing a remote, unauthenticated attacker to gain root access to the device. The CVSS 3.1 score is 9.8 (Critical) with a network attack vector and no required privileges. CISA's SSVC assessm...

CVE-2026-51679

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68881

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

EUVD-2026-68542

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...