CVE-2026-12695

CVE-2026-12695 concerns the miniOrange 2FA WordPress plugin (pre-6.2.6). The vulnerability arises because the plugin does not validate the submitted one-time password (OTP) against the targeted user’s stored secret; instead it verifies the OTP against an attacker-supplied value. This enables an u...

CVE-2026-12251 Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a...

Qnap QTS and QuTS hero OS Command Injection (CVE-2025-66279)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

Qnap QTS and QuTS hero Stack-based Buffer Overflow (CVE-2025-66280)

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...

Qnap QTS and QuTS hero Path Traversal (CVE-2026-24717)

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the...

Qnap QTS and QuTS hero OS Command Injection (CVE-2025-66273)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

PT-2026-66722

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the group policy evaluation logic of Keycloak. When a group policy is configured to extend permissions to child groups, the system employs a simple text-based prefix check t...

Qnap QuTS hero NULL Pointer Dereference (CVE-2025-62850)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2026-67207

CVE-2026-67207 affects Wolf CMS up to version 0.8.3.1. The vulnerability is an authorization bypass in the BackupRestoreController caused by a PHP operator precedence flaw in the permission check expression. This allows authenticated non-administrative users to access restricted backup functional...

PT-2026-66574

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.6.0 Description Authenticated non-admin users can enumerate sequential custom option IDs to read labels belonging to admin-only user or group custom fields. This occurs because the endpoint "/api/v3/custom...

PT-2026-66601

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.2 Description An authorization bypass exists in the BackupRestoreController due to a PHP operator precedence flaw in the permission check expression. This allows authenticated users without administrative...

CVE-2026-52539

CVE-2026-52539 affects Outstatic CMS

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

CVE-2026-59243

The CVE-2026-59243 vulnerability affects the apache-airflow-providers-fab package before 3.7.3, where the FAB auth manager’s Azure AD OAuth login defaulted verify_signature=False when decoding the ID token. An attacker who can present a forged or unsigned (alg:none) ID token to the OAuth callback...

CVE-2026-63237

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts...

CVE-2026-63237

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts...

CVE-2026-18072

The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the arveucinit function — registered on WordPress's init hook at priority 1 so...

CVE-2026-15344

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-18072

CVE-2026-18072 is a supply-chain backdoor in the WordPress plugin “Advanced Responsive Video Embedder” (version 10.8.7). The root cause, as reported by Wordfence, is a hardcoded master credential used by the internal function _arve_uc_init() to bypass authentication. The backdoor accepts a token ...

CVE-2026-18072 Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter

The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the arveucinit function — registered on WordPress's init hook at priority 1 so...