There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has a critical vulnerability (CVE-2026-105639) affecting versions prior to 1.4.0. The signup flow creates a logged-in user record for any submitted email without verifying ownership. This allows an unauthenticated attacker to register with a victim's email, enumerate pending workspace invitations, and accept them, gaining unauthorized access with the invited role. The issue is fixed in version 1.4.0.
CVE-2026-71885 is a critical vulnerability in Bouncy Castle for Java (BC-JAVA) versions before 1.86 affecting the Messaging Layer Security (MLS) implementation. The flaw involves improper certificate validation where the X.509 certificate chain is not properly bound to the LeafNode's signature key, allowing an attacker to impersonate another party's identity within a group. This can lead to unauthorized admission, eviction of legitimate members, and decryption and injection of group messages. The issue is fixed in version 1.86 by enforcing that the end-entity certificate's public key matches the signature key as required by RFC 9420. Deployments using only basic credentials are not affected.
The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have obtained a valid `burst_share_token`, such as one that has been shared publicly or distributed to an untrusted party.
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
The JSON API Auth plugin for WordPress up to version 3.1.2 suffers from an authentication bypass vulnerability due to cached session cookie disclosure. The parent plugin caches authenticated responses keyed only by URI and query string, ignoring HTTP method and POST body, causing authenticated cookies to be exposed to unauthenticated GET requests. Attackers can retrieve a valid Administrator session cookie and fully authenticate as the Administrator. Exploitation requires the parent plugin to be active with the Auth controller enabled and a recent legitimate Administrator authentication. The vulnerability has a critical CVSS score of 9.8.
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.
Divi Membership plugin for WordPress versions up to 2.3.0 contains an authentication bypass vulnerability. The vulnerability arises from the process_paypal_callback function accepting a base64-encoded paypal_param GET parameter without proper validation or verification. This allows unauthenticated attackers to impersonate any WordPress user, including administrators, by supplying an arbitrary user ID. The vulnerability leads to full site takeover. The PayPal gateway class is always instantiated, making the vulnerable code active on every front-end request.
DevKit Pro plugin for WordPress versions up to and including 2.3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to take over administrator accounts. The flaw arises because the plugin trusts an attacker-controlled cookie to identify privileged users and incorrectly verifies capabilities on that user instead of the actual requester. This enables attackers to obtain a valid nonce and escalate privileges to full administrator access, leading to complete site takeover.
Tapo C120 v1 and C200 V5
do not adequately protect login challenge data or sanitize
attacker-controlled input processed by the MacTool handler. An unauthenticated
attacker on the same local network can replay login challenge data to obtain an
administrative session, enable a privileged service that becomes accessible
after a reboot, and submit crafted input to execute arbitrary commands within
the device management process.
Successful
exploitation may allow arbitrary command execution on the camera and compromise
the confidentiality, integrity, and availability of the affected device.
Exploitation requires access from the same local network, replay of the login
challenge data, activation of the privileged service, and a device reboot.
Improper Authentication vulnerability in Apache APISIX.
On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue affects Apache APISIX: from 3.12.0 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_customer_after_checkout` function. This is due to the publicly accessible `wu_ajax_nopriv_wu_validate_form` AJAX handler accepting a freely obtainable checkout nonce, and the `checkout_form=wu-finish-checkout` parameter causing `get_validation_rules()` to discard all validation rules while `finish_checkout_form_fields()` returns an empty step list — forcing `is_last_step()` to return true and routing the request directly into full order processing — after which `maybe_create_customer()` resolves the attacker-supplied `email_address` to an existing WordPress user ID without any authentication or ownership verification, and `login_customer_after_checkout()` calls `wp_set_auth_cookie()` for that user ID via a passwordless code path. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including a Network Super Admin — simply by knowing their email address. Exploitation requires that the targeted user account has no pre-existing Ultimate Multisite customer record; accounts such as a Network Super Admin on a fresh Multisite install, or any administrator or editor added before Ultimate Multisite was configured, satisfy this condition and are therefore exploitable.
CVE-2026-102106 is an improper authentication vulnerability in the Kiteworks Email Protection Gateway administrative service. The service fails to consistently enforce administrator authentication, allowing attackers referencing a valid administrator account to bypass password checks. This flaw enables unauthorized creation, modification, or deletion of internal users and managed domains, as well as changes to security configurations. Deleting a managed domain can remove its user accounts and potentially lock out legitimate administrators.
CVE-2026-102128 is an improper authentication vulnerability in Kiteworks Email Protection Gateway. It allows the gateway to act on the Kiteworks platform on behalf of an unauthenticated user and provision platform accounts for unknown identities. A remote attacker without authentication could exploit this flaw to gain control over a platform account. The vulnerability affects versions prior to 9.5.1. The CVSS score is 7.5, indicating high severity due to the potential for unauthorized account control without user interaction.
CVE-2026-88920 is a critical authentication bypass vulnerability in the DOM security processor of Apache WSS4J. It enables unauthenticated remote attackers to forge authenticated SOAP messages by exploiting a crafted unsigned SAML sender-vouches assertion with an attacker-controlled key. This vulnerability is fixed in Apache WSS4J versions 4.0.2, 3.0.6, and 2.4.4.
The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record.
CVE-2026-92227 is a high-severity improper authentication vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. The flaw involves premature issuance of a rememberme cookie that allows bypassing multi-factor authentication (MFA). This vulnerability enables attackers to circumvent MFA protections without user interaction or privileges.