Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting

Bulk Me Now! WordPress plugin = 2.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

CVE-2026-56750

A flaw was found in Gitea. An attacker who steals a user's "Remember Me" token can maintain unauthorized access to the user's account. This occurs because the system fails to invalidate the attacker's session even after the legitimate user logs out or changes their password. This vulnerability ca...

CVE-2026-76207

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...

EUVD-2026-62448

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...

CVE-2026-76207 phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...

CVE-2026-76207 phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...

CVE-2026-76207

phpMyFAQ before 4.1.7 issues remember-me cookies before 2FA verification, allowing attackers with valid credentials to skip the 2FA challenge and replay the cookie for full authenticated access. CVSS 8.1 HIGH. No in-the-wild exploitation reported. Upgrade to 4.1.7; advisory at https://github.com/...

CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-56750

CVE-2026-56750 describes a vulnerability in Gitea where Remember-Me tokens fail to invalidate prior attacker sessions, enabling session persistence after compromise. The root cause is described as deficiencies in access control, potentially enabling privilege-related impact. Publicly documented i...

CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-68760 Potential remember-me authentication bypass in JFrog Artifactory

An unauthenticated user may bypass authentication under specific cache conditions...

CVE-2026-68760

CVE-2026-68760 affects JFrog Artifactory (per CVE listings) with an unauthenticated bypass of authentication under specific cache conditions. The connected documents identify a remember-me authentication bypass scenario but do not specify affected versions, vulnerable component paths, root cause ...

SUSE CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-71206

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase...

CVE-2026-71206

Shiori CVE-2026-71206 affects the JWT CheckToken flow: it validates only the HMAC signature and returns the embedded claims.Account without re-fetching from the DB, with no session store or token revocation. Deletion or demotion of an account does not invalidate existing tokens, so an attacker co...

CVE-2026-71206 shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase...

CVE-2026-71206 shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase...

EUVD-2026-53203

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or...

WhatsApp account takeover scam asks you to “vote for my friend”

A scam is spreading through WhatsApp with the goal of taking over victims' accounts entirely. It starts with a message that feels harmless and familiar. Someone—often a contact whose account has already been compromised—asks you to support a friend or relative of theirs by voting in an online...