EUVD-2026-51708

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-14561 Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-14561

The Authora : Easy login with mobile number WordPress plugin, in versions before 1.7.7 , contains an unauthenticated account takeover vulnerability. The flaw exists because the plugin fails to maintain the confidentiality of its one-time login code , exposing both the code and a valid verificatio...

CVE-2026-14561

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-14561 Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-14309

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their...

CVE-2026-14309 Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their...

CVE-2026-14309

The Chat On Desk Order Notifications WordPress plugin (versions before 1.0.9 ) is vulnerable to an unauthenticated account takeover due to a failure to verify that a one-time password (OTP) has been validated before processing a password-reset request. If SMS one-time-password password reset is e...

EUVD-2026-51721

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their...

PT-2026-67044

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

Malicious code in @one-chat/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c7db3f85373ec3f62997e6019402e390ab07d37ef0f129fdfa168b9503da7e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @one-chat/react is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-54785 gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to th...

CVE-2026-51785

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

Friday Squid Blogging: Squid Helps Discover New Marine Species

The Squid is a new scientific machine: One of the technological breakthroughs was the onboard use of a spinning wheel confocal microscope, nicknamed the Squid, which uses lasers to scan microscopic details of how organisms are put together. "That opens up a whole new world of exploring. We could...

Security Bulletin: IBM Storage Protect Server is susceptible to vulnerabilities due to Golang library related to ObjectAgent(CVE-2026-39824).

Summary Golang library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang is affected by multiple vulnerabilities that may cause data integrity issues, or memory handling problems when processing specially crafted input. This bulletin identifies the steps to address...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that may allow an attacker to trigger denial-of-service conditions. (CVE-2026-5516, CWE-362)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow an attacker to trigger denial-of-service conditions, unexpected behavior, or excessive resource consumption, that could impact the security of t...

EUVD-2026-51627

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...

WordPress GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin GamiPress versions = 7.9.9.1...

[R2] Stand-alone Security Patch Available for SC Versions 6.6.4, 6.7.5 and 6.8.0 on Tenable Enclave Security: SC202607.2

R2 Stand-alone Security Patch Available for SC Versions 6.6.4, 6.7.5 and 6.8.0 on Tenable Enclave Security: SC202607.2 Jason Schavel Fri, 07/31/2026 - 13:00 Security Center on Tenable Enclave Security leverages third-party software to help provide underlying functionality. Several of the...