CVE-2026-81801 WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability

Subscriber Settings Change in WP-Stateless = 4.4.1 versions...

CVE-2026-81801

The WP-Stateless WordPress plugin (versions ≤ 4.4.1) is affected by a Settings Change vulnerability discovered by Johan Buenavida via Patchstack. The flaw allows a low-privileged user (e.g., subscriber) to modify settings they should not have access to, over a network with low complexity and no u...

PT-2026-89444

Subscriber Settings Change in WP-Stateless = 4.4.1 versions...

CVE-2026-81801: Missing Authorization

Subscriber Settings Change in WP-Stateless = 4.4.1 versions...

WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability

Settings Change vulnerability discovered by Johan Buenavida in WordPress Plugin WP-Stateless versions = 4.4.1...

CVE-2026-65633

Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. The bearer-token authentication helper AshAuthentication.Plug.Helpers.retrievefrombearer/3...

CVE-2026-65633 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. The bearer-token authentication helper AshAuthentication.Plug.Helpers.retrievefrombearer/3...

CVE-2026-65633 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. The bearer-token authentication helper AshAuthentication.Plug.Helpers.retrievefrombearer/3...

Fedora 43 : coturn (2026-13e2cf6827)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-13e2cf6827 advisory. Coturn 4.17.2 What's Changed Fix outgoing UDP TTL pinned to 1 on client-facing sockets Coturn 4.17.1 Gate merges on the more tests suites build: Dro...

BIT-CONSUL-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...

CVE-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

CVE-2026-73431: Authentication Bypass by Capture-replay

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

CVE-2026-68206

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code...

CVE-2026-68229

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 refpiclist0/refpiclist1 entries from the stateless slice control and later uses their indices to look up decode-dpb in cedruswritereflist. Rejecting...

CVE-2026-68229 media: cedrus: skip invalid H.264 reference list entries

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 refpiclist0/refpiclist1 entries from the stateless slice control and later uses their indices to look up decode-dpb in cedruswritereflist. Rejecting...

CVE-2026-68206

The CVE-2026-68206 entry pertains to the Linux kernel, specifically the media: v4l2-ctrls path for HEVC, where the common validation of slice parameters did not verify active L0/L1 reference counts before driver-specific code ran. Red Hat, Ubuntu, Debian, NVD, and other sources describe a flaw th...

CVE-2026-68206 media: v4l2-ctrls: validate HEVC active reference counts

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code...

CVE-2026-68206 media: v4l2-ctrls: validate HEVC active reference counts

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code...

PT-2026-69606

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description HEVC slice parameters are shared stateless V4L2 controls. The common validation path fails to verify the active L0/L1 reference counts before they are consumed by driver-specific code...

Security Bulletin: consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...