CVE-2026-120554

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.5.11 . The flaw exists in the ACUI_Cron::save_settings() function due to a non-atomic multi-option write sequence . The function persists several settings—includi...

EUVD-2026-116806

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the ACUICron::savesettings function, which persists acuicronactivated, acuicronconfiguredby,...

PT-2026-135428

Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0...

Active-Directory-BadSuccessor

Active-Directory-BadSuccessor Overview In this room, we explore the BadSuccessor privilege escalation technique, a vulnerability that abuses delegated Managed Service Accounts dMSAs in Active Directory. The attack allows a user with sufficient control over a dMSA object to impersonate another...

Invoke-BadSuccessor.ps1

Invoke-BadSuccessor Abuse Delegated Managed Service Accounts dMSA creation rights on vulnerable Organizational Units OUs to escalate privileges in Active Directory environments BadSuccessor vulnerability – CVE-2025-53779. Overview Invoke-BadSuccessor automates a privilege escalation attack chain ...

Progress Software WS_FTP Server path traversal vulnerability

Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.7 and prior to 2025.0.4. These vulnerabilities stem from a path traversal issue, which may allow the delegated host administrator to access or modify files outside their authorized scope...

SUSE CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

PT-2026-134539

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

CVE-2026-113682

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an...

CVE-2026-113682

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an...

EUVD-2026-105098

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an...

PT-2026-118480

Name of the Vulnerable Software and Affected Versions Networknt light-4j versions 2.1.5 through 2.3.x Description An authentication bypass exists in the BasicAuthHandler function. Unauthenticated attackers can log in as LDAP/AD-delegated users by sending a Basic Authorization header containing a...

Debian dla-4834 : keystone - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4834 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4834-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-111905 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

CVE-2026-111905 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

CVE-2026-111905 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

CVE-2026-111905

The software phpMyFAQ versions 3.2.0 (before 4.1.9) and 4.2.0-alpha (before 4.2.0-beta) is vulnerable to an Insecure Direct Object Reference (IDOR) in the GET /admin/api/user/data/{userId} endpoint. The root cause is the lack of a SuperAdmin or protected-target check, allowing the API to return t...

CVE-2026-111893 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions wit...

CVE-2026-111888 phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWSDELETE instead of NEWSEDIT. Attackers holding addnews and delnews can read the...

CLSA-2026-1792154919 Fix CVE(s): CVE-2026-106553, CVE-2026-106555, CVE-2026-106583

SECURITY UPDATE: GSSAPI client state persisting across authentication attempts - debian/patches/CVE-2026-106555.patch: reset the GSSAPI client state at the start of each userauth request and of each pre-authentication GSSAPI context setup in the monitor. - CVE-2026-106555 SECURITY UPDATE: GSSAPI...