CVE-2026-76793 Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

EUVD-2026-64224

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-77001

CVE-2026-77001 is a critical unauthenticated authentication bypass in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin (through 1.2.0 ). A publicly accessible login handler performs no authentication, authorisation, or nonce checks , allowing any unauthenticated atta...

CVE-2026-77001 Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...

CVE-2026-77002

The SmilePass Selfie Login WordPress plugin through version 1.0.2 lacks any server-side verification of the identity it is asked to authenticate. This allows unauthenticated users to log in as any registered account, including administrators , resulting in full compromise of confidentiality, inte...

CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 fails to verify the email address in a Firebase authentication token before matching it to a WordPress account and issuing a session. This allows unauthenticated attackers to log in as any user, including administrators, by crafting a toke...

CVE-2026-76793 Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

EUVD-2026-64225

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...

CVE-2026-77002 SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...

EUVD-2026-64219

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052

CVE-2026-18052 affects the ManageWP Worker WordPress plugin in versions prior to 4.9.37 . The plugin's auto-login mechanism fails to bind the target account to the cryptographic signature that authorises the login, and does not prevent replay of an already-used login link. An attacker who obtains...

EUVD-2026-64218

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...

Fedora 44 : ceph (2026-7de7d03796)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7de7d03796 advisory. Ceph 20.2.4 GA CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC...

PT-2026-79515

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

MiracleLinux 9 : iscsi-initiator-utils-6.2.1.11-1.git4b3e853.el9_8.2 (AXSA:2026-1615:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1615:01 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path...

Fedora 43 : ceph (2026-ebffec502b)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ebffec502b advisory. Ceph 19.2.6 GA CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC...

PT-2026-79518

Name of the Vulnerable Software and Affected Versions SmilePass Selfie Login versions prior to 1.0.3 Description The SmilePass Selfie Login WordPress plugin fails to perform server-side verification of the identity during the authentication process. This flaw allows unauthenticated users to bypas...

CVE-2026-53525

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...

CVE-2026-48106

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope length, opcode of inbound messages. The MsgReplicateSync payload itself is...