CVE-2026-11454

The Groundhogg WordPress plugin (versions <= 4.5.2) is affected by an Insecure Direct Object Reference via GET /wp-json/gh/v4/contacts/. The endpoint’s permission callback only checks a role-level view_contacts capability, and read_single() returns full contact records without object-level own...

UBUNTU-CVE-2026-67589

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

EUVD-2026-53119

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator...

CVE-2026-15372 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator...

CVE-2026-16055 Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Galle...

CVE-2026-15372 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator...

CVE-2026-15372

The WP 2FA WordPress plugin, in versions prior to 4.1.0 , contains an improper authentication vulnerability. The flaw exists because the plugin fails to validate the second authentication factor when specific supported methods are selected during login. An attacker who possesses a user's password...

CVE-2026-16055 Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Galle...

CVE-2026-16055

The Contest Gallery WordPress plugin, in versions prior to 30.0.7 , is vulnerable to an improper authentication flaw. The plugin fails to route its front-end login through the standard WordPress authentication flow, instead issuing an authentication cookie immediately after a password check. This...

CVE-2026-16036

The miniOrange 2FA WordPress plugin (versions before 6.2.7 ) is vulnerable to a 2FA Bypass due to an improper authentication flaw. The plugin fails to bind the second factor configured during the pre-login two-factor challenge to the target account's existing factor. This allows an attacker who p...

EUVD-2026-53120

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled...

CVE-2026-16036 miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled...

CVE-2026-16736

The User Registration & Membership WordPress plugin versions before 5.2.6 is vulnerable to an improper access control issue. The plugin fails to enforce the site's registration-disabled setting when processing registration-form submissions. This allows unauthenticated users to successfully create...

CVE-2026-16736 User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled

The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration...

CVE-2026-67589 Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-67588

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CLSA-2026-1785906878 TuxCare security update for org.jsoup:jsoup (2 CVEs)

TuxCare rebuilt org.jsoup:jsoup to address 2 CVEs. Fixed in 1.7.3-tuxcare.1...

CLSA-2026-1785906695 TuxCare security update for commons-fileupload:commons-fileupload (2 CVEs)

TuxCare rebuilt commons-fileupload:commons-fileupload to address 2 CVEs. Fixed in 1.3.1-tuxcare.1...

CVE-2020-9684

creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:04+00:00| seen| https://t.me/timcorehacking/946 2026-08-06 00:00:55+00:00| seen| https://t.me/timcorehacking/946...

Vulnerability in Cosminexus HTTP Server

Overview VulnerabilityCVE-2026-49975 has been found in Cosminexus HTTP Server. This vulnerability does not apply if HTTP/2 protocol is disabled. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the...