CVE-2026-92965

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...

CVE-2026-92965 TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...

EUVD-2026-83679

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...

CVE-2026-92965 TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...

CVE-2026-92965

The TikTok WordPress plugin versions 1.2.0 through 1.4.1 is vulnerable to unauthenticated OAuth code redemption . The root cause is a failure to verify request authorization when processing a sign-in code provided in the URL. This allows any visitor to force the site to redeem an arbitrary code a...

EUVD-2026-82495

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

CVE-2026-16582 Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia WordPress plugin is vulnerable to unauthenticated payment bypass in versions up to and including 2.4.5 . The root cause is that the plugin accepts a client-supplied package-redemption identifier as proof of payment without properly validat...

CVE-2026-16582: Missing Authorization

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

Linux Distros Unpatched Vulnerability : CVE-2026-48717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the...

CVE-2026-48717

OpenAM Community Edition (through 16.0.6) contains an Improper Authorization flaw (CWE-285) in its OAuth2 authorization-code grant flow. The token endpoint only validates code_verifier when the realm-wide codeVerifierEnforced setting is enabled—a setting that ships disabled by default . When an a...

EUVD-2026-78369

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

EUVD-2026-75887

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-81905

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-81905: Incorrect Authorization

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-81905 Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-81905 Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-81905 Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-81905

Concrete CMS versions below 9.5.3 store user validation hashes (email/registration validation, password reset, persistent login) in a single table with a type column, but the redemption path resolves a hash by value alone without verifying its type . This allows a long-lived registration hash (60...