CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs plugin for WordPress (before 4.8.0 ) contains an authentication method downgrade vulnerability. An unauthenticated attacker can supply a specific GET parameter that bypasses capability checks and nonce verification, forcing the plugin to use Basic HT...

CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-76670

CVE-2026-76670 affects the API of HPE Networking EdgeConnect SD-WAN Orchestrator . The vulnerability is an authorization bypass that permits a remote, low-privileged authenticated user to escalate to administrative privileges , resulting in complete system compromise . The CVSS 3.1 score is 9.9 (...

CVE-2026-0187

In gsaswpkhashcompare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0187

In gsaswpkhashcompare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-79152

In gsaswpkhashcompare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0187

CVE-2026-0187 is a privilege escalation vulnerability affecting the GSA component on Google Pixel devices. The root cause is a logic error within the gsa_sw_pk_hash_compare function in image-auth-srv.c. An attacker with System execution privileges can exploit this flaw to achieve a local escalati...

CVE-2026-0187

In gsaswpkhashcompare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

Malicious Package

Overview fulfillment-cuprum-auth-widget is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

CVE-2026-54547

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...

CVE-2026-53459 Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database...

CVE-2026-54547 Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...

CVE-2026-54547 Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...

EUVD-2026-78886

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...

CVE-2026-54547 Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...

CVE-2026-55863

CVE-2026-55863 affects motionEye (mEye) , a web interface for the motion video surveillance daemon. The root cause is a missing @BaseHandler.auth() decorator on the ActionHandler.post() method in motioneye/handlers/action.py (CWE-862), leaving the /action// endpoint accessible without authenticat...

CVE-2026-46488 motionEye: Authentication possible via password hash

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meyeusername and meyepasswordhash cookies as authentication material without server-side session...

CVE-2026-91992

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

CVE-2026-58196

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol MCP servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP...