CVE-2026-75977 Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbwgethashkey function that uses the current user's identity instead of the cookie username...

CVE-2026-75977

Mang Board WP WordPress plugin (all versions ≤ 2.3.7 ) suffers from a Missing Authorization vulnerability via authentication cookie forgery. The root cause is flawed HMAC generation in mbw_get_hash_key(), which uses the current user's identity instead of the cookie's username parameter when a Wor...

python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens

A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...

Linux Distros Unpatched Vulnerability : CVE-2017-17806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HMAC implementation crypto/hmac.c in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing ...

Important: booth

Issue Overview: A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcrymdgetalgodlen, it may allow an invalid HMAC to be accepted by the Booth server. CVE-2024-3049 Affected Packages: booth Note: This advisory is applicable to Amazon Linux 2 AL2 Core...