CVE-2026-51376

An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service by sending an unauthenticated MESSAGE packet into the mesh gossip cache . A Proof of Concept (PoC) for this vulnerability, described as a BLE cache poisoning attack, is available in the provided documents. S...

CVE-2026-51640

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to incorrect access control in the getMeshNeighborTable function. This flaw allows unauthenticated attackers to obtain sensitive mesh neighbor information by sending a crafted POST request to the /cgi-bin/cstec...

PT-2026-83175

An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache...

PT-2026-83155

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

CVE-2026-19084: External Control of File Name or Path

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...

CVE-2026-51633

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83053

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An unauthenticated attacker can cause a denial of service for Sieve script management by sending a small malformed command before authentication, which crashes the ManageSieve login process. The...

OpenRGB-1.0~rc3.1+git0.g5e81e26f-1.1 on GA media (moderate)

OpenRGB-1.0rc3.1+git0.g5e81e26f-1.1 on GA media Announcement ID: openSUSE-SU-2026:11602-1 Rating: moderate Cross-References: CVE-2026-59682 CVSS scores: CVE-2026-59682 SUSE : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2026-59682 SUSE : 8.8...

CVE-2026-19318 Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic...

CVE-2026-77977 Ebyte NA111-M Missing Authentication for Critical Function

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings,...

CVE-2026-75814 Ebyte NA111-M Cross-Site Request Forgery

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

On August 19th, 2026, during internal research, I discovered an Authentication Bypass vulnerability in WPMU DEV Dashboard, a WordPress plugin with an estimated 350,000 active installations. This vulnerability makes it possible for unauthenticated attackers to gain administrator access when Hub...

CVE-2026-81827

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-54713 CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-67465

A flaw was found in Apache Qpid Proton-Dotnet. A remote, unauthenticated attacker could exploit this vulnerability by leveraging unbounded symbol value caching, which can lead to resource exhaustion. This can cause a denial of service DoS, making the affected system unavailable to legitimate user...

EUVD-2026-66760

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account...

PT-2026-82788

Name of the Vulnerable Software and Affected Versions Ebyte NE2-D11 affected versions not specified Description The web management interface of the device fails to restrict the interface from being rendered within an external frame. This allows an unauthenticated remote attacker to use a crafted...

CVE-2026-81271: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in GeoDirectory = 2.8.176 versions...

CVE-2026-78137: Missing Authorization

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO...

PT-2026-82837

Name of the Vulnerable Software and Affected Versions WPMU DEV Dashboard versions prior to 5.0.2 Description An authentication bypass exists in the Hub Single Sign-On SSO flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a...