CVE-2026-90457: Use of Password Hash With Insufficient Computational Effort

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

PT-2026-90526

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

GO-2026-6368 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList

OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList...

GO-2026-6392 SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking in github.com/siyuan-note/siyuan/kernel

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking in github.com/siyuan-note/siyuan/kernel...

CVE-2026-78361 zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...

CVE-2026-78361: Missing Authorization

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...

Incomplete List of Disallowed Inputs

Overview pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper validation of the Certificate field during offline login...

CVE-2026-86199

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server...

EUVD-2026-74910

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server...

CVE-2026-86199 PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server...

CVE-2026-86199

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. An unauthenticated player can trigger an uninitialized property access error that crashes the server , resulting in a denial of service. The issue is resolved in version 5.43....

CVE-2026-86199 PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server...

CVE-2026-86199 PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server...

CVE-2026-86199: Incomplete List of Disallowed Inputs

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server...

PT-2026-89002

🚨 HIGH SEVERITY: CVE-2026-86199 CVSS 7.5 PocketMine-MP 5.43.1 vulnerable to unauthenticated server crash via certificate validation bypass. Patch immediately. CVE Vulnerability PatchNow ThreatIntel CyberSecurity https://t.co/RrkmnFX0tI...

Security Bulletin: IBM Documentation Offline is vulnerable to `Denial of Service via __proto__ header name in req.headersDistinct` due to Node.js (CVE-2026-21710)

Summary IBM Documentation Offline utilizes Node.js as a third-party component, which contains a vulnerability that could potentially affect your product's stability and security. CVE-2026-21710 CVSS: 3.1 is a denial-of-service DoS vulnerability identified in the Node.js core HTTP module. An...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053293)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053293 advisory. In the Linux kernel, the following vulnerability has been resolved: sched/smt: Fix unbalance schedsmtpresent dec/inc I got the following warn report while doing stre...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053333)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053333 advisory. In the Linux kernel, the following vulnerability has been resolved: block: Fix handling of offline queues in blkmqallocrequesthctx This patch prevents that test...

CVE-2026-86187 WWBN AVideo Weak PRNG Password Generation via External Login

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-86187: Use of Insufficiently Random Values

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...