CVE-2026-10795-Lab

CVE Lab: CVE-2026-10795 - UpdraftPlus UpdraftCentral RPC Authentication Bypass Chained to Plugin Installation Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-10795, an unauthenticated authentication bypass vulnerability affecting the UpdraftPl...

CVE-2021-26088

PoC for CVE-2021-26088 written in PowerShell Description An improper authentication vulnerability in FSSO Collector may allow an unauthenticated user to bypass any firewall authentication rule and access the protected network via sending specifically crafted UDP login notification packets...

CVE-2026-95524

Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-94457

Unauthenticated Bypass Vulnerability in Captcha Code = 3.32 versions...

EUVD-2026-85493

Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95524

The WP User Frontend WordPress plugin, affecting versions

EUVD-2026-85489

Unauthenticated Bypass Vulnerability in Netgsm = 2.10.0 versions...

CVE-2026-95514

The Netgsm WordPress plugin, affecting versions

CVE-2026-95514 WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Netgsm = 2.10.0 versions...

EUVD-2026-85478

Unauthenticated Bypass Vulnerability in Captcha Code = 3.32 versions...

CVE-2026-94457

The WordPress Captcha Code plugin (versions ≤ 3.32 ) is vulnerable to an unauthenticated bypass vulnerability. While the specific root cause and practical consequences are not detailed in the provided documents, the flaw allows for a bypass of security measures. No specific exploits, mitigation s...

SUSE CVE-2026-73553

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignorepathparametersinpathmatching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC urlpath matcher evaluates the raw path. ...

CVE-2026-86800

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

PT-2026-92068

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0 Description Unauthenticated attackers can bypass the protocol policy to establish RDSTLS connections even when the server policy has explicitly disabled them. This is achieved by sending incompatible protocol...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5 through 0.9.3) fails to verify the authenticity of incoming payment notification webhooks before acting on them. An unauthenticated attacker who knows a store's merchant identifier can mark arbitrary orders as paid , or can...

CVE-2026-66674

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...

EUVD-2026-75512

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...

PT-2026-89426

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...

WordPress B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More plugin < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass vulnerability

Unauthenticated B2B Group Assignment and Approval Bypass vulnerability discovered by Farid Narimanov in WordPress Plugin B2BKing versions 5.2.40...