CWE-290 vulnerabilities

Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.

Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.

Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.

CVE-2026-104891 is an authentication bypass vulnerability in the douglasborthwick-crypto mppx-condition-gate packages. These packages improperly grant free access to payment routes by trusting a client-supplied wallet address without verifying control over that wallet. This allows attackers to name any qualifying wallet address and bypass payment. All published versions of both packages are affected. Fixed versions will require proof of wallet control before granting free access. Until patched, removing the condition gate or ensuring prior wallet binding is recommended.

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.

Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.

Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.

A vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2 allows remote attackers to bypass authentication by spoofing due to a flaw in the opendmarc_policy_query_dmarc function within the Multi-Record Set Handler component. The vulnerability has a CVSS score of 7.3 (medium severity). Exploit code is publicly available, but no vendor response or patch has been provided.

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.

CVE-2026-94416 is an authorization bypass vulnerability in Red Hat Ansible Automation Platform 2.6 for RHEL 9. It allows an authenticated administrator to create a service key indistinguishable from a legitimate one, enabling forging of service-authentication tokens. This can lead to impersonation of the Controller service and signing of Workload Identity Tokens for arbitrary workloads. Downstream resource servers trusting the gateway OIDC key may accept these forged tokens and disclose credentials beyond the attacker's authorization boundary. Red Hat has released an important security update addressing this issue.

Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the affected non-TLS web interfaces and disclose configuration information. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.

Joplin Server versions prior to 3.7.2 contain an authentication bypass vulnerability in the SSO login process. The UserModel.ssoLogin() method does not verify the is_external flag when matching accounts by IdP-asserted email. This allows an attacker with a valid IdP session to impersonate a local user and gain unauthorized access to that user's notes, files, and settings without knowing their password. The issue is resolved in version 3.7.2.