CVE-2026-100835 Contrast before 1.16.0 Remote Attestation Relay Attack

Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to...

CVE-2026-100603

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

CVE-2026-100603

The ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow. Four distinct ordinary authenticated accounts can coordinate to report a visible skill, triggering its automatic hiding (moderationStatus: hidden) from the catalog without a moderator's decisio...

EUVD-2026-87698

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

CVE-2026-100603 ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

CVE-2026-100603 ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

CVE-2026-100603 ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

CVE-2026-100603: Improper Control of Interaction Frequency

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

CVE-2026-97538

In the Linux kernel, the following vulnerability has been resolved: hwmon: asusrogryujin Validate HID report lengths rogryujinrawevent parses response headers and payload fields without first checking that they are present in the received report. A short report can therefore make the driver consu...

CVE-2026-97538

The Linux kernel contains a vulnerability in the asus_rog_ryujin hwmon driver. The function rog_ryujin_raw_event() fails to verify the presence of response headers and payload fields in received reports. This allows a short report to cause the driver to consume uninitialized bytes from the HID tr...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)

Last week, there were 362 vulnerabilities disclosed in 247 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 186 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-87739

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

EUVD-2026-85812

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

CVE-2026-87739 PaperCut MF/NG: User permissions are not evaluated on report generation

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

CVE-2026-87739

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. Because user permissions are not evaluated during this process, an attacker can submit report generation requests without valid credentials. This flaw allows for the...

CVE-2026-87739 PaperCut MF/NG: User permissions are not evaluated on report generation

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

PT-2026-97724

Name of the Vulnerable Software and Affected Versions PaperCut MF/NG affected versions not specified Description An improper authentication issue allows an unauthenticated remote attacker to trigger report generation. By submitting requests without valid credentials, an attacker can generate...

PT-2026-98195

Name of the Vulnerable Software and Affected Versions @rsdoctor/rspack-plugin versions prior to 1.5.16 Description The default report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint without authentication and with...

CVE-2026-87739: Authorization Bypass Through User-Controlled Key

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

CVE-2026-84787

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...