CVE-2026-19572 FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

CVE-2026-19572

A security vulnerability exists in FlexNet Publisher lmadmin within a SOAP handler . A hardcoded authentication bypass allows an unauthenticated user to obtain a privileged administrator session without providing valid credentials. No information regarding specific affected versions, remediation ...

PT-2026-107406

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

CVE-2026-19572: Authentication Bypass Using an Alternate Path or Channel

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

PT-2026-107527

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

CVE-2026-104678: Improper Access Control

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

CVE-2025-70520: Missing Authentication for Critical Function

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

CVE-2025-70516: Missing Authentication for Critical Function

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

CVE-2025-70516

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

EUVD-2025-211051

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

EUVD-2025-211047

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

EUVD-2025-211045

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request...

CVE-2025-70520

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

CVE-2025-70516

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

CVE-2025-70517

The request handler in Fanvil x7a firmware version 2.6.0.1182 fails to enforce cross-origin resource protection for state-changing requests. This lack of protection allows for a complete bypass of the cross-origin boundary, enabling Cross-Site Request Forgery (CSRF) attacks against any applicatio...

CVE-2025-70516

The Fanvil x7a device, running firmware version 2.6.0.1182 , contains a vulnerability in its websocket handler due to a lack of proper authentication restrictions for sessionless users. This security flaw allows unauthenticated attackers to access various device resources, including operational l...

CVE-2025-70520

The Fanvil x7a device, running firmware version 2.6.0.1182 , contains a vulnerability in its websocket handler due to a lack of proper authentication restrictions against sessionless users. This security weakness allows any user to access sensitive device resources , including operational logs an...

PT-2026-107523

Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2025-70516 Vendor → Unknown Severity → Critical — CVSS 9.1 Product → Unknown Date → 2026-10-07 A critical vulnerability Missing Authentication for Critical Function has been disclosed...

PT-2026-107391

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

PT-2026-107524

Name of the Vulnerable Software and Affected Versions Fanvil x7a version 2.6.0.1182 Description The request handler fails to enforce cross-origin resource protection for state-changing requests. This allows the cross-origin boundary to be bypassed, enabling Cross-Site Request Forgery CSRF attacks...