CVE-2026-58677

In getsecurebootmode of auth.rs, there is a possible way to bypass root signature verification via fault injection due to a logic error. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

AVTECH DVR - Login Verification Code Bypass

AVTECH DVR products are vulnerable to verification code bypass just by entering the "login=quick" parameter to bypass verification code. id: CVE-2013-4982 info: name: AVTECH DVR - Login Verification Code Bypass author: ritikchaddha severity: low description: | AVTECH DVR products are vulnerable t...

WordPress FraudLabs Pro SMS Verification plugin 1.11.2-1.12.1 - Unauthenticated SMS Verification Bypass vulnerability

Unauthenticated SMS Verification Bypass vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin FraudLabs Pro SMS Verification versions 1.11.2-1.12.1...

CVE-2026-106008 FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified

The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS...

CVE-2026-106008 FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified

The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS...

nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames

A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...

CVE-2026-106008: Unknown FraudLabs Pro SMS Verification: The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity…

The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS...

zeroheight-account-verification-bypass-CVE-2025-65925

CVE-2025-65925 — Zeroheight Incorrect Access Control in Account Creation Flow Disclosure Date: 2025-06-11 Vendor fix date per vendor: 2025-06-13 Researcher validation date: 2025-06-26 Discovered by: Sneden Rebello Summary A legacy user creation API pathway allowed accounts to be created without...

CVE-2020-10759-poc

Summary Exploits CVE-2020-10759 - fwupd PGP signature verification bypass. See https://github.com/justinsteven/advisories/blob/master/2020fwupddanglings3bucketandCVE-2020-10759signatureverificationbypass.md for more details. Requirements Note: You need to install python3-gpg from your OS vendor...

WordPress Quick Event Manager plugin 9.9.5-9.18 - Unauthenticated PayPal IPN Verification Bypass vulnerability

Unauthenticated PayPal IPN Verification Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Quick Event Manager versions 9.9.5-9.18...

CVE-2026-121636

The Quick Event Manager WordPress plugin (versions 9.9.5 through 9.18) contains a vulnerability where it fails to verify the authenticity of PayPal payment notifications . This flaw is triggered via the 'debug' parameter , allowing unauthenticated attackers to bypass IPN verification and mark eve...

CVE-2026-121636 Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter

The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment...

WordPress WCFM Membership plugin < 2.12.1 - Subscriber+ Payment Verification Bypass vulnerability

Subscriber+ Payment Verification Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WCFM Membership versions 2.12.1...

CVE-2026-85248

A flaw was found in the Apache Camel Post-Quantum Cryptography PQC component. The component reuses a single cryptographic signature instance across concurrent message exchanges without proper thread synchronization. Under concurrent processing conditions, signature operations from different...

CVE-2026-113799

A flaw was found in slack-morphism. When signature verification fails for an incoming request, the library calculates the expected Hash-based Message Authentication Code HMAC signature and records it in error logs. An attacker with network access to the Slack callback endpoint and read access to...

CVE-2026-12967 WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass

The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role...

CVE-2026-12967

The WCFM Membership WordPress plugin (versions before 2.12.1 ) contains a Subscriber+ Payment Verification Bypass vulnerability. The root cause is a failure to verify that a payment was successfully made before completing a paid membership registration. This allows any authenticated Subscriber/Cu...

CVE-2026-122321

Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string such as a tag rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit...

EUVD-2026-117231

Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string such as a tag rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit...

CVE-2026-122321

Kyverno versions 1.18.0 before 1.19.2 are vulnerable to a signature verification bypass in the verifyImages component. The root cause is that cached verification results are keyed by the image reference string (e.g., a tag) instead of being bound to the verified digest. This allows an attacker wi...