CVE-2026-15985

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

EUVD-2026-66410

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

CVE-2026-15985

The Classified Listing – Mobile Number Verification WordPress plugin is vulnerable to unauthenticated authentication bypass in all versions up to and including 1.6.0 . The root cause is missing server-side Firebase OTP validation in the process_otp_login() function, allowing an attacker to authen...

WordPress Classified Listing - Mobile Number Verification plugin <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login vulnerability

WordPress Classified Listing - Mobile Number Verification plugin = 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Classified Listing - Mobile Number Verification versions = 1.6.0...

multi_exploit_wp

WordPress Multi-Exploit Tool - HFT404 !Versionhttps://img...

PoCWorkbench

PoCShell PoCWorkbench Desktop-based PoC management and ve...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a vulnerability due to Apache Commons HttpClient

Summary Apache Commons HttpClient is used by IBM Integrated Analytics System as an HTTP client library. CVE-2012-6153 affects Apache HttpComponents due to an incomplete fix related to SSL certificate hostname verification. The library fails to verify that the server hostname matches the domain na...

EUVD-2026-66295

A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app...

CVE-2026-15365

CVE-2026-15365 affects vivo Kids Mode , where a pop-up logic flaw in a certain feature allows users to bypass password verification and access Quick Apps outside the app. The vulnerability requires a physical attack vector and is scored CVSS 4.0 Base 2.4 (LOW) , with low impact on confidentiality...

CVE-2026-78146

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...

CVE-2026-77695

The Return Refund and Exchange For WooCommerce WordPress plugin (versions before 4.6.4 ) contains an improper access control vulnerability. The plugin fails to properly verify ownership of guest orders during certain AJAX actions exposed to unauthenticated users. This allows an attacker to read p...

EUVD-2026-66274

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

CVE-2026-14550

The WPCafe WordPress plugin, in versions prior to 3.0.18 , is vulnerable to an unauthenticated reservation approval bypass . The issue stems from a missing authorization check within the plugin's REST API during reservation creation. The API verifies only a publicly available nonce , which allows...

CVE-2026-80192

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

SUSE CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview @better-auth/sso is a SSO plugin for Better Auth Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the verifyDomain route in packages/sso/src/routes/domain-verification.ts and the domain-based assignment logic in...

PT-2026-82167

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/vfio ccw component where the first Indirect Data Address Word IDAW in a list is read separately to calculate the buffer size for the full Indirect Data Addres...

Fedora 44 : curl (2026-2f88b83676)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2f88b83676 advisory. - Fix QUIC zero-length UDP datagrams busy-loop CVE-2026-11352 - Fix WS Auto-PONG memory exhaustion CVE-2026-11586 - Fix proto-default skips SSH...

Amazon Linux 2 : ipa, --advisory ALAS2-2026-3877 (ALAS-2026-3877)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3877 advisory. A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the...

CVE-2026-47841: Undefined Security Weakness

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...