CVE-2026-64961

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-64961

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

EUVD-2026-63361

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-64961 Authentication Bypass in ATutor

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

EUVD-2026-63349

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-15706

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-77081

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...

CVE-2026-66594

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

EUVD-2026-63315

Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...

EUVD-2026-63314

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

EUVD-2026-63313

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

CVE-2025-15689

The WordPress Capella theme (≤2.5.5) allows unauthenticated remote privilege escalation with no user interaction, rated CVSS 9.8 critical. No root cause, patch version, or exploit details are provided in the documents; see the Patchstack advisory for further information. Exploitation status is no...

CVE-2026-77081

n8n's GraphQL node bypasses allowed-domains policy when Authentication is set to expression mode: with two different credential types attached, only the first credential's domain policy is enforced while both are transmitted, letting an authenticated workflow author exfiltrate a domain-restricted...

CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

EUVD-2026-63245

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CVE-2026-11861

In FreeIPA, when a trust relationship with Active Directory is configured, services fail to verify the Privilege Attribute Certificate (PAC) in Kerberos TGS tickets, allowing an authenticated AD user to impersonate a client name and bypass authentication for the portal, SMB server, and LDAP direc...

CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CVE-2026-14951

The FDS Web interface of FDS102 firmware for FAdC/FAdCi R2 lacks CSRF protection headers, allowing a low-privileged remote attacker to trick authenticated users into executing unintended actions via malicious web pages. Exploitation details are not provided; refer to the VDE-2026-078 advisory for...

EUVD-2026-63221

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...