MStore API <= 3.9.1 - Authentication Bypass

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated...

Alibab-Nacos-Unauthorized-Login

취약점 영향 Nacos = 2.1.0에 영향을 주는 Nacos에서 문제가 발견되었습니다. Nacos 사용자가 기본 JWT 키를 사용하여 무단 액세스 취약점이 발생합니다. 이 취약점을 통해 공격자는 사용자 이름과 비밀번호 인증을 우회하고 Nacos 사용자로 직접 로그인할 수 있습니다. 취약점 제품 Nacos = 2.1.0 버전 취약점 재현 1단계：Nacos 웹사이트에 직접 접속하여 임의의 사용자 이름과 비밀번호를 입력하고 Burpsuite로 패킷을 캡처합니다. 2단계：응답 패킷을 가로챕니다. 3단계: 데이터 패킷을 다음과 같이...

CVE-2026-70403

XING CPTrans-ME-X contains a Use of Hard-coded Password CWE-259. Anyone with the knowledge of the credential may log in to the affected device...

CVE-2026-69657

XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...

EUVD-2026-70919

XING CPTrans-ME-X contains a Use of Hard-coded Password CWE-259. Anyone with the knowledge of the credential may log in to the affected device...

CVE-2026-69657

XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...

CVE-2026-69657

XING CPTrans-ME-X contains a Use of Default Password vulnerability (CWE-1393), meaning anyone who knows the default credential can log in to the affected device. The vulnerability is rated CRITICAL with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 base score...

PT-2026-85411

🚨 CRITICAL: CVE-2026-69657 CVSS 9.8 XING CPTrans-ME-X uses default passwords allowing unauthorized remote access. Attackers can gain full control with no authentication required. Action: Change default credentials immediately. CVE Vulnerability PatchNow https://t.co/1Y4Tw4gKye...

CVE-2026-64940

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2026-6180

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notificatio...

CVE-2026-49443

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, an...

Movable Type 安全漏洞

Movable Type is a content management system developed by Movable Type Inc. There is a security vulnerability in Movable Type, which stems from a lack of authorization verification. This vulnerability may allow users without administrator privileges to log in and perform unexpected updates...

EUVD-2026-27231

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notificatio...

CVE-2026-6180

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notificatio...

CVE-2026-6180

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notificatio...

CVE-2026-6180 PaperCut MF: Card truncation on HP readers

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notificatio...

CVE-2026-6180 PaperCut MF: Card truncation on HP readers

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notificatio...

CVE-2026-6180

PaperCut MF/NG suffers a race condition in processing badge-swipe data from certain HP devices, under dropped/out-of-order packet conditions. The issue can cause a truncated badge ID to be registered, and in environments with custom badge-ID post-processing scripts, the truncated value may map to...

AZL-81701 CVE-2026-27855 affecting package dovecot 2.3.20-1

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation in the authentication process when callbackmode is set to direct. An attacker can gain unauthorized access to a victim's session by initiating an authentication request and tricking the victim into visiting a crafted UR...