The Germanized for WooCommerce WordPress plugin up to version 4.1.4 has a vulnerability allowing unauthorized access to private data via activation token reuse. This occurs when the 'Disable login for unactivated customers' setting is set to No, which is a non-default configuration. Attackers with Subscriber-level access can change their account email to a victim's billing email and redeem their original activation token to link the victim's past orders to their account, exposing sensitive billing information. Exploitation requires public customer registration, double opt-in enabled, and token redemption within one day.
FileRise versions prior to 3.23.0 have an authentication flaw where failed TOTP verification attempts are tracked per session rather than account-wide. This allows an attacker with valid primary credentials to bypass the intended five-attempt limit for second-factor authentication by restarting login attempts in new sessions. The issue is resolved in version 3.23.0.
CVE-2026-70079 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions. It involves improper enforcement of behavioral workflow in the Windows DNS component, which allows an unauthorized attacker to cause a denial of service over a network. The vulnerability affects multiple Windows versions prior to specific fixed releases. An official fix is available from Microsoft.
CVE-2026-19878 is a medium severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access that allows a remote authenticated attacker to bypass additional authentication workflow steps. This affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability relates to improper enforcement of behavioral workflow, potentially reducing the effectiveness of multi-step authentication processes.
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
A vulnerability exists in macrozheng mall versions 1.0.0 through 1.0.3 in the Payment Status Endpoint (/order/paySuccess). The issue involves manipulation of the orderId argument, which can enforce unintended behavioral workflow remotely. The vendor has not provided a patch or explanation, and the GitHub issue was deleted without comment. The CVSS score is 5.4, indicating a low severity level with limited impact on confidentiality but some impact on integrity and availability.
CVE-2026-55763 is a high-severity vulnerability in klever-go, the Go implementation of the Klever blockchain protocol. Prior to version 1.7.19, a logic flaw in the processPercentageRoyaltiesTransfer function allows a 100% royalty split to be processed without debiting the source account, resulting in unbounded off-the-books inflation of the KDA token supply. This occurs because the function returns early when royaltiesToPay reaches zero, before subtracting the amount from the sender's balance. The issue is fixed in version 1.7.19.
CVE-2026-78103 is a medium severity vulnerability in WatchGuard Dimension version 2.0. It involves a server-side configuration endpoint that does not enforce the client-side lock/unlock workflow, allowing an authenticated administrator with read-write access to bypass the intended editing workflow and overwrite configuration changes made by another concurrent administrator session.
CVE-2026-78618 is a business logic flaw in WatchGuard Dimension version 2.0 that allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request. The vulnerability has a medium severity with a CVSS score of 6.9. There is no official patch or remediation level currently provided by the vendor. The flaw requires high privileges (administrator) and does not involve user interaction. No known exploits are reported in the wild.
Weblate versions prior to 2026.8 contain an authentication bypass vulnerability where an authenticated user can change their account's primary email without verifying the new address. This allows acceptance of team invitations sent to the new email without access to the intended recipient's mailbox. The issue is fixed in version 2026.8.
CVE-2026-15365 is a low-severity vulnerability in vivo's Kids Mode feature. It involves a pop-up logic flaw that allows users to bypass password verification and access Quick Apps outside the Kids Mode app. The vulnerability is categorized under CWE-841, indicating improper enforcement of behavioral workflow. No affected versions or patches have been specified, and there are no known exploits in the wild.
Our payment integration with GiroCheckout did not properly validate
payment status responses. An attacker could use a successful payment
status response from one payment and supply it to the system for a
different payment, gaining access to multiple valid tickets with only
one payment.
A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.
IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to perform unauthorized actions due to the improper enforcement of behavioral workflow.
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
Our payment integration with Mollie did not properly validate payment
status responses. An attacker could use a successful payment status
response from one payment and supply it to the system for a different
payment, gaining access to multiple valid tickets with only one payment.