CVE-2026-65570 WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

EUVD-2026-53988

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability

Bypass vulnerability vulnerability discovered by she11f in WordPress Plugin Login with phone number versions = 1.8.70...

Amazon and Apple impersonated in “$149.99 unauthorized charge” scam

If you’ve spent any time browsing lately, you may have run into a full-screen popup warning you that your Apple ID or Amazon account was just used for a mysterious $149.99 purchase. It looks urgent. It looks official. And if you look at two examples side by side, it becomes obvious that it’s...

WordPress Authora : Easy login with mobile number plugin < 1.7.7 - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover vulnerability

WordPress Authora : Easy login with mobile number plugin 1.7.7 - Easy Login with Mobile Number 1.7.7 - Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Authora : Easy login with mobile number versions 1.7.7...

CVE-2026-12713 WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

CVE-2026-12713

The WPCargo Track & Trace WordPress plugin versions before 8.0.4 is vulnerable to an unauthenticated SQL injection due to improper sanitization and escaping of a parameter used in a SQL statement. Specifically, the vulnerability exists in the wpcargo_tracking_number functionality. This flaw allow...

SUSE CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

EulerOS 2.0 SP15 : shim (EulerOS-SA-2026-2951)

According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: When a delta CRL that contains a Delta CRL Indicator extensionx000D is processed a NULL pointer dereference might happen if the...

CVE-2026-8470

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

CGA-FM5W-93VC-V533

Bulletin has no description...

CVE-2026-20200

creationtimestamp| type| source ---|---|--- 2026-08-05 17:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96776 2026-08-06 00:00:33+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96776 2026-08-06 10:50:29+00:00| seen|...

MAL-2026-12617 Malicious code in claims-format-masked-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6 The package advertises phone-number masking but on every require loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque...

MINI-27P7-34MC-MW35

Bulletin has no description...

CVE-2026-71264

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

ECHO-FAEA-4126-B8F7

Bulletin has no description...

MINI-45X5-FVM5-VC6M

Bulletin has no description...

CVE-2026-15210

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...