CVE-2026-12571

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...

CVE-2026-12571

The CVE-2026-12571 entry describes an authentication bypass in ManageEngine DDI Central’s password-reset workflow that enables account takeover. The NVD entry confirms a critical impact (CVSS 3.1: 9.8, NETWORK attack vector, no user interaction) with high impact on confidentiality, integrity, and...

CVE-2026-12571 Authentication Bypass Leading to Account Takeover

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...

EUVD-2026-56557

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...

CVE-2026-12571 Authentication Bypass Leading to Account Takeover

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...

CVE-2026-68292

A flaw was found in the Linux kernel's ice driver. During a Peripheral Component Interconnect PCI reset, the driver incorrectly allocates a timestamp ring due to a faulty check of the Virtual Station Interface VSI type. This allocated memory is not properly released, leading to a memory leak...

CVE-2026-68210

A flaw was found in the Linux kernel's media: stm32: dcmi driver. When the dcmigraphinit function fails to initialize due to issues with resetcontrolassert or resetcontroldeassert, an asynchronous notifier is not properly unregistered. This oversight can lead to resource leaks, potentially causin...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token vulnerability

Authenticated Subscriber+ Arbitrary Password Reset via Encrypted Object Token vulnerability discovered by daroo in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.9...

wan: wanxl: Only reset hardware after BAR mapping

...

rbd: Reset positive result codes to zero in object map update path

...

WordPress TrueBooker – Appointment Booking and Scheduler System plugin <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset vulnerability

Missing Authorization to Unauthenticated Arbitrary Password Reset vulnerability discovered by thevietronin in WordPress Plugin TrueBooker versions = 1.2.3...

WordPress TrueBooker – Appointment Booking and Scheduler System plugin <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset vulnerability

Missing Authorization to Unauthenticated Arbitrary Password Reset vulnerability discovered by Nhien Pham nhienit in WordPress Plugin TrueBooker versions = 1.2.3...

CVE-2026-12571: Improper Authentication

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...

PT-2026-70365

Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central affected versions not specified Description An authentication bypass exists in the password-reset workflow, which could allow an attacker to perform an account takeover. Recommendations At the moment, there is no...

Linux Distros Unpatched Vulnerability : CVE-2026-68307

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. Afte...

Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability allows an attacker-controlled user-id value supplied to the password reset endpoint to reach a HoneySQL query as raw SQL. On installations using the default embedded H2...

PT-2026-70914

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

Linux Distros Unpatched Vulnerability : CVE-2026-68319

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdscore: fix deadlock between reset thread and remove pciresetfunction acquires devicelock before performing the reset. pdscremove is called by the PCI core wit...

Linux Distros Unpatched Vulnerability : CVE-2026-68292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ice: prevent tstamp ring allocation for non-PF VSI types The pf-txtimetxqs bitmap tracks which Tx queues have ETF Earliest TxTime First offload enabled. This...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...