Statamic: Account takeover via OAuth email matching without email-verification check

Impact When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a...

CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...

CVE-2026-14812 Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection)

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker...

CVE-2026-14812

The CVE-2026-14812 entry concerns the Premium SEO WordPress plugin, which is reported to ship an unauthenticated backdoor that can create a hidden administrator account. In some builds it may also enable remote code execution, server-side request forgery, and arbitrary front-end script/content in...

CVE-2026-66662

Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66470

Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66662

CVE-2026-66662 concerns an Unauthenticated Privilege Escalation in the WordPress plugin Frontend Admin by DynamiApps targeting versions up to 3.29.10 . Affected component is the plugin’s frontend admin functionality; the underlying cause is not detailed in the provided documents beyond the unauth...

CVE-2026-66662 WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps = 3.29.10 versions...

EUVD-2026-53888

Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66470

The CVE-2026-66470 entry affects the WordPress plugin “Frontend Admin by DynamiApps” versions up to 3.29.10 (

CVE-2026-66470 WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability

Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...

OPENSUSE-SU-2026:21543-1 Security update for python-Django

This update for python-Django fixes the following issues: Changes in python-Django: - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997 - CVE-2026-15337: potential denial-of-service vulnerability in checkforlanguage bsc1272998 - CVE-2026-15830: potential...

Microsoft 365 Admin Center Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client (pre-10.11.1.0) contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially disclose information and hijack active sessions, impersonating users (including admins). Dell recommends upgrad...

CVE-2026-12605

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...

EUVD-2026-53925

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...

CVE-2026-12605

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...

CVE-2026-11983

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the aiajax function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that ...

EUVD-2026-53865

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the aiajax function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that ...

CVE-2026-11983 Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the aiajax function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that ...