236 matches found
DEBIAN-CVE-2026-75595
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...
PT-2026-78652
Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.90 Description An issue exists where the isFileValid function in models/fileValidation.js relies on the Unix file command for content-based MIME detection. When the file binary is unavailable, the detectMimeFromFile...
CVE-2026-73379
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...
EUVD-2026-60794
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...
CVE-2026-16269
The Newsletters WordPress plugin (before 4.16) fails to strictly compare its API authentication key, enabling an unauthenticated bypass of API authentication through type juggling. This allows attackers to perform privileged actions when the optional API is enabled, such as modifying subscriber r...
CVE-2026-15239 Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...
CVE-2026-15239
CVE-2026-15239 affects the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (pre-1.42.0). The vulnerability arises because the Turnstile validation cache isn’t bound to the single-use challenge token, instead tying to an attacker-controlled reusable request value, enabling unauthenticate...
EUVD-2026-54180
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments...
CVE-2026-15208 RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification
The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore...
CVE-2026-11361 Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...
CVE-2026-11361
Formidable Forms for WordPress (before 6.32.1) is affected by CVE-2026-11361 due to improper validation of PayPal subscription status, enabling unauthenticated users to bypass payment and trigger paid actions (content access, license delivery, membership activation) without charges. Impact aligns...
CVE-2026-65570
Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...
CVE-2026-65502
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
CVE-2026-32469
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...
EUVD-2026-53988
Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...
CVE-2026-65570 WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...
CVE-2026-65570
Technical details about CVE-2026-65570 are not publicly available in the provided documents. The records only state an unauthenticated bypass in the WordPress plugin up to version 1.8.70; no specifics on exploit vectors or fixes are included. Monitor for updates.
CVE-2026-32469 WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...