MLS X.509 credential not bound to the LeafNode signature key
CVE-2026-71885
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509
#cwe-287
共收录 1077 条相关情报。
← 返回所有主题The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in ...
CVE-2026-97343
The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to I
Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
CVE-2026-97343
The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to I
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of...
CVE-2026-91078
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS acco
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once...
CVE-2026-103514
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allo
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, an...
CVE-2026-91078
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS acco
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has ...
CVE-2026-103514
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allo
Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
CVE-2026-71416
### Summary The Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests be
A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown functio...
CVE-2026-104638
A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699
The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability...
CVE-2026-97637
The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in al
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been con...
CVE-2026-81740
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to th...
CVE-2026-19660
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.
The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to t...
CVE-2026-14378
The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker...
CVE-2026-102369
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on th...
CVE-2026-102369
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed
Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple is...
CVE-2026-94276
Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspectio
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to...
CVE-2026-103264
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and
Fleet before 4.87.0 Authentication Bypass via Device Identifiers
CVE-2026-103264
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via th...
CVE-2026-75957
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication B
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOT...
CVE-2026-103651
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (