CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

EUVD-2026-67800

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-81019

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

GHSA-2VH6-HW4J-32WW gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

Summary gix-packetline panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the gix client process during a normal fetch. This is a pre-authentication,...

CVE-2026-56854

A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. This oversight could allow a remote attacker to bypass intended network-based access control...

CVE-2026-75124 PLANET GS-4210-16P2S V3 Memory Corruption via dispatcher.cgi _readHttpParam

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parsequerystring to process...

EUVD-2026-67784

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parsequerystring to process...

CVE-2026-75124 PLANET GS-4210-16P2S V3 Memory Corruption via dispatcher.cgi _readHttpParam

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parsequerystring to process...

CVE-2026-75124

PLANET GS-4210-16P2S firmware prior to 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface. The root cause is in the _readHttpParam function, which copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_que...

EUVD-2026-67741

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Emiliano Carrizo in WordPress Plugin RegistrationMagic versions = 6.0.9.8...

CVE-2026-81020 wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...

CVE-2026-81019 wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...

WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SiteGround Security versions = 1.6.6...

Chromium: CVE-2026-79108 UI misrepresentation in Web Authentication (Passkeys & Security Keys)

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-79178 Incorrect authorization in Web Authentication (Passkeys & Security Keys)

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

WordPress Firebase Authentication plugin < 1.7.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Abdullah Kareem in WordPress Plugin Firebase Authentication versions 1.7.1...

WordPress WPMU DEV Dashboard plugin <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion vulnerability

Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion vulnerability discovered by WordFence in WordPress Plugin WPMU DEV Dashboard versions = 5.0.1...

CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...