CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2026-76581 WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2026-76581

CVE-2026-76581 is a Critical (CVSS 9.8) unauthenticated Authentication Bypass in the WPMU DEV Dashboard plugin for WordPress (≤ 5.0.1 , ~350,000 installs). The root cause is HMAC canonicalization confusion between two unauthenticated AJAX actions: wdpsso_step1 signs an unseparated concatenation o...

EUVD-2026-67464

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2026-76581: Improper Verification of Cryptographic Signature

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2026-81718

opensslencrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles or encrypted files can brute-force wrapping password...

CVE-2026-81718: Inadequate Encryption Strength

opensslencrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles or encrypted files can brute-force wrapping password...

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations By Maulik Maheta and Henry Bernabe · August 27, 2026 Executive Summary Active Directory misconfigurations are vulnerabilities that attackers can exploit before defenders notice them. This blog exposes a stealthier...

VulnCheck KEV: CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

PT-2026-82837

Name of the Vulnerable Software and Affected Versions WPMU DEV Dashboard versions prior to 5.0.2 Description An authentication bypass exists in the Hub Single Sign-On SSO flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a...

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations By Maulik Maheta and Henry Bernabe · August 27, 2026 Executive Summary Active Directory misconfigurations are vulnerabilities that attackers can exploit before defenders notice them. This blog exposes a stealthier...

CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-12587

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587 Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587 Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587

CVE-2026-12587 affects the Virtuagym application, where a static, hard-coded badge_number parameter is used as the HMAC private key for generating physical access QR codes. This value is exposed via the API endpoint /club/_id_club_/member/_id_member_/resamania_qr_info, and the cryptographic logic...

CVE-2026-75977

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbwgethashkey function that uses the current user's identity instead of the cookie username...

CVE-2026-75977 Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbwgethashkey function that uses the current user's identity instead of the cookie username...

CVE-2026-75977 Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbwgethashkey function that uses the current user's identity instead of the cookie username...

CVE-2026-75977

Mang Board WP WordPress plugin (all versions ≤ 2.3.7 ) suffers from a Missing Authorization vulnerability via authentication cookie forgery. The root cause is flawed HMAC generation in mbw_get_hash_key(), which uses the current user's identity instead of the cookie's username parameter when a Wor...