CVE-2026-12586

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user including an administrator and take over the account...

CVE-2026-16256

The CVE-2026-16256 entry concerns the POUCO Import Users WordPress plugin (

CVE-2026-12586

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user including an administrator and take over the account...

CVE-2026-14864

CVE-2026-14864 affects the JetEngine WordPress plugin up to version 3.8.12. The vulnerability arises because a post meta value is not escaped before being output by a JetEngine shortcode, enabling Stored XSS when exploited by users with Contributor role or higher. Impact is that an attacker could...

CVE-2026-18571

CVE-2026-18571 affects Keycloak’s user creation flow when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. The flaw lets a sub-administrator with permission to create users add those users to any group, including groups the administrator isn’t authorized to manage, potentially enabling una...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571 Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-8457

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple idtoken and decoding only its base64 payload without verifying the JWT signature against Apple'...

CVE-2026-18556 Unauthenticated administrative account takeover

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1...

CVE-2026-18556 Unauthenticated administrative account takeover

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1...

CVE-2026-67334

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67334

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

EUVD-2026-51828

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67343

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

EUVD-2026-51843

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67343

ArcadeDB before version 26.7.2 fails to redact the arcadedb.ha.clusterToken in GET /api/v1/server, enabling authenticated users to read the token in cleartext. With the leaked value combined with headers X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User, an attacker can impersonate root and ...

EUVD-2026-51867

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

CVE-2026-67352

CVE-2026-67352 affects luci-app-https-dns-proxy. A stored XSS flaw exists in the resolver_url parameter; authenticated users can inject active HTML, which is rendered as raw HTML on the HTTPS DNS Proxy status page and can execute JavaScript in the admin’s browser origin. Documents provide CVSS me...

CVE-2026-17605

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...