CVE-2026-16184 IBM WebSphere Application Server is affected by an authentication bypass

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request...

CVE-2026-16184

CVE-2026-16184 affects IBM WebSphere Application Server 9.0 and 8.5, enabling an authentication bypass via a crafted unauthenticated request. IBM’s security bulletins tie this vulnerability to WebSphere components used with Rational ClearQuest/JazzSM, and provide remediation guidance. The recomme...

CVE-2026-66474

CVE-2026-66474 is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin Insert Headers and Footers Code – HT Script up to version 1.1.8 . The issue is described as CSRF in versions

CVE-2026-14190

CVE-2026-14190 concerns the Sina Extension for Elementor WordPress plugin (before 3.10.2). An unauthenticated AJAX handler reflects a value reconstructed from request input into the HTML response without escaping, enabling reflected XSS : unauthenticated attackers can trigger a crafted request to...

CVE-2026-65540

CVE-2026-65540 affects the WordPress plugin “Popup for CF7 with Sweet Alert” (versions <= 1.6.5). The vulnerability is a reported unauthenticated Cross Site Request Forgery (CSRF) weakness in this plugin. The CVSS data indicate: AV:N, AC:L, PR:N, UI:R, S:C, C:L, I:L, A:L, base score 7.1 (HIGH)...

Incorrect Implementation of Authentication Algorithm

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm via the webhook token validation process. An attacker can execute arbitrary scheduled job...

CVE-2026-57852

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

CVE-2026-57852

Affected product/Component: Grav CMS scheduler-webhook plugin. Vulnerability: Authentication bypass due to a short-circuit logic flaw in the webhook token validation, allowing unauthenticated remote attackers to trigger configured scheduled jobs. Impact (as described): An unauthenticated POST to ...

CVE-2026-11349

The CVE concerns the Modern Event Calendar plugins for WordPress (Pro and Lite) before version 7.34.0, where an unauthenticated AJAX action uses an unsanitized request parameter in a SQL statement, causing an unauthenticated SQL injection. Root cause: lack of sanitization/escaping of the paramete...

Uncontrolled Resource Consumption

github.com/forgekeep/nebula-mesh is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the unauthenticated /ui/oidc/login endpoint creating and storing a new OIDC state for every request without rate limiting or a maximum state limit, which allows an attacker to repeated...

CVE-2026-59695 Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price. When the mpp Elixir library is configured as fee payer feepayer: true,...

EUVD-2026-42852

The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-9838 ICS Calendar <= 12.0.9 - Reflected Cross-Site Scripting via 'htmltagtitle' Parameter

The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-9838

The CVE-2026-9838 entry concerns the ICS Calendar plugin for WordPress. It describes a Reflected Cross-Site Scripting (XSS) vulnerability via the htmltagtitle parameter in all versions up to and including 12.0.9. The root cause is insufficient input sanitization and output escaping, with exploita...

CVE-2026-46592

A flaw was found in the Apache Camel CXF SOAP component. A remote attacker can exploit this vulnerability by manipulating the operationName header in an unauthenticated HTTP request. This improper input validation allows the attacker to force the CxfProducer to invoke unintended SOAP operations o...

EUVD-2026-42073

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint this route is not covered by the dashboard middleware matcher, so no authorization check is applied. The sudoPassword field from the request body is written to t...

PT-2026-55576

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.6 Description An unauthenticated peer can cause the Node.js process to terminate, resulting in a denial of service. This occurs when the server receives a normal HTTP request with a malformed Host heade...

PT-2026-55035

Name of the Vulnerable Software and Affected Versions Booked versions prior to 3.0.1 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to induce a user to perform actions they did not intend to execute. Recommendations Update to a version newer...

CVE-2026-49049

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...

PYSEC-2026-339 FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Impact The POST /api/v2/firefighter/raid/jirabot endpoint CreateJiraBotView is reachable without authentication permissionclasses = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validation, then uploaded as an attachment on the Jira ticket that get...