Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers

Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability. According to the cloud computing and virtualization technology company, the issues affect customer-managed...

EUVD-2026-63349

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-15706

CVE-2026-15706 is a critical authentication bypass in the Management API of Baylan Smart Meter Management Application (BMS) by Baylan Measuring Instruments Industry and Trade Inc. The vulnerability stems from missing authentication for a critical function , allowing unauthenticated network access...

CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-77081

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...

CVE-2026-77073

n8n versions before 2.34.1 contain a credential validation bypass in the MCP createworkflowfromcode tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references...

CVE-2026-74001

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-66677

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

CVE-2026-66594

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

EUVD-2026-63315

Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...

EUVD-2026-63314

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-74001

User Registration & Membership Pro is a WordPress plugin affected by an unauthenticated broken authentication vulnerability in versions ≤ 5.4.5 , enabling account takeover without any prior credentials. The flaw was discovered by 0xd4rk5id3 and carries a CVSS 3.1 score of 9.8 (CRITICAL) with a ne...

CVE-2026-74001 WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

EUVD-2026-63313

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

EUVD-2026-63305

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

CVE-2026-66677

CVE-2026-66677 is a Broken Authentication vulnerability in the WordPress plugin Leyka affecting versions

CVE-2026-66677 WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

CVE-2025-15689

The WordPress Capella theme (≤2.5.5) allows unauthenticated remote privilege escalation with no user interaction, rated CVSS 9.8 critical. No root cause, patch version, or exploit details are provided in the documents; see the Patchstack advisory for further information. Exploitation status is no...

CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...