Threat Library

The MyHome Core plugin for WordPress (versions up to 4.4.5) contains an authentication bypass vulnerability that allows unauthenticated attackers to hijack unconfirmed user accounts, including administrator accounts, under specific configuration conditions. Successful exploitation grants full administrative access to the WordPress site, enabling complete site takeover.

The Custom User Registration Fields for WooCommerce WordPress plugin (up to v2.2.3) allows unauthenticated attackers to escalate privileges to Administrator by manipulating the checkout request. The vulnerability arises from unsanitized user-controlled role data being passed directly into WordPress's role assignment function, enabling full site takeover during account registration at checkout.

Cloud Commander before version 19.20.2 contains a critical directory traversal vulnerability in its REST file-operation and markdown endpoints, allowing unauthenticated or minimally privileged attackers to read, write, move, or copy files outside the configured root directory. With a CVSS score of 9.8, this flaw can lead to full system compromise, data exfiltration, or arbitrary file overwrite.

argocd-mcp version 0.8.0 exposes its HTTP transport on all network interfaces without enforcing authentication on incoming MCP sessions, even when an ARGOCD_API_TOKEN is configured. Any attacker with network access to the listener can invoke the full MCP tool surface, leveraging the operator's stored Argo CD token to create applications, trigger syncs, and modify GitOps resources without any credentials of their own.

A critical pre-authentication vulnerability in ownCloud (CVE-2023-49105, CVSS 9.8) was actively exploited by a suspected Chinese-speaking threat actor to breach a nuclear research institute in the Philippines and exfiltrate sensitive records. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation and prompting mandated remediation for federal agencies.

Five critical vulnerabilities have been disclosed across popular WordPress plugins and themes—WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP—that can lead to authentication bypass, account takeover, and remote code execution. The most severe flaw, CVE-2026-76581, carries a CVSS score of 9.8 and allows attackers to bypass authentication controls entirely. These issues pose significant risk to any organization running affected WordPress installations, as exploitation could lead to full site compromise.

ASE2000 V2 Communications Test Set versions 2.25 through 2.37 contain two vulnerabilities: an XML External Entity (XXE) flaw inherited from a bundled outdated Apache log4net library, and an improper TLS certificate validation flaw affecting IEC 60870-5-104 secure communications. Successful exploitation could allow attackers to read/write arbitrary local files, trigger outbound network requests, or perform man-in-the-middle attacks to intercept and modify protected substation/grid communications.

A critical authentication bypass exists in Omnivore's API where the Apple sign-in JWT verification logic trusts the attacker-controlled 'alg' header field, enabling a classic RS256-to-HS256 algorithm confusion attack. An attacker can forge valid authentication tokens for any Apple-linked account by signing them with Apple's public RSA key treated as an HMAC secret, resulting in full account takeover without valid credentials.

rust-iot-platform contains a critical authentication bypass vulnerability in which most REST API endpoints lack authentication checks in their handler code. Unauthenticated attackers can fully manage user accounts—creating, listing, retrieving, updating, and deleting them—leading to complete account and access control compromise.

Shinobi, an open-source video surveillance/NVR platform, ships with a hardcoded connection key in its child node service that allows unauthenticated attackers to authenticate via WebSocket handshake and execute arbitrary SQL queries. This grants full read/write access to user records and camera configuration, enabling account takeover and surveillance system compromise.

The Sigma Forms Pro WordPress plugin (versions up to 1.4.5) contains a critical vulnerability that allows unauthenticated attackers to achieve remote code execution by exploiting improper capability handling and MIME type validation during form submissions. Several default plugin templates ship with unrestricted file upload fields, making exploitation immediately feasible on default installs without any attacker reconnaissance or configuration changes.

IBM Concert versions 1.0.0 through 2.3.1 contain a critical SQL injection vulnerability that allows a remote, unauthenticated attacker to manipulate backend database queries. Exploitation could result in unauthorized viewing, modification, or deletion of sensitive application data. With a CVSS score of 9.1, this vulnerability poses significant risk to organizations running unpatched instances.

A critical flaw in IBM Langflow OSS allows an authenticated user to escalate from limited flow-building privileges to full arbitrary command execution on the server. By crafting a malicious 'type' field in a saved flow and triggering a build via a wrapper flow, an attacker bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false safeguard intended to block custom code execution. This effectively hands the attacker OS-level control of the agent server process.

Attackers are actively chaining two vulnerabilities in PaperCut NG and MF print management software to achieve unauthenticated remote code execution. PaperCut has released an emergency patch with additional hardening after confirming exploitation in the wild. Organizations running unpatched PaperCut servers face full server compromise with no authentication required.

A critical, unpatched balance-handling flaw in the shared Cosmos EVM module was actively exploited between August 20-25, 2026, to drain funds from at least six blockchains built on the Cosmos ecosystem. Cosmos Labs was reportedly aware that all chains running the vulnerable module were exposed prior to exploitation, raising concerns about disclosure timing and coordinated patching failures.

A maximum-severity vulnerability in the GiveWP WordPress donation plugin allows unauthenticated attackers to execute arbitrary commands on the hosting server. Given GiveWP's widespread use on nonprofit and fundraising websites, this flaw exposes a large number of internet-facing servers to full compromise without requiring any credentials.

McKesson, a major healthcare and pharmaceutical distribution company, disclosed a breach involving unauthorized access to third-party applications, with the ShinyHunters extortion group claiming theft of 284 million patient records. The incident highlights ongoing risks from third-party application compromise and large-scale extortion campaigns targeting healthcare data supply chains.

The Ebyte NA111-M cellular/MQTT gateway (firmware 9013-2-17) contains 13 vulnerabilities, several rated critical (CVSS 9.8), including missing authentication, client-side authentication bypass, weak cryptographic hashing, and cleartext transmission/storage of credentials including MQTT traffic. Combined, these flaws allow unauthenticated remote attackers to fully compromise the device, gaining administrative control, intercepting or replaying credentials, and disrupting availability. Ebyte has not delivered a patch despite CISA coordination attempts, leaving deployed units permanently exposed absent compensating network controls.

IBM Langflow versions 1.0.0 through 1.11.1 contain a critical flaw in the Agent-to-Agent (A2A) public endpoint that fails to properly enforce security restrictions, allowing a remote unauthenticated attacker to execute arbitrary code. With a CVSS score of 9.8, this is a severe, easily exploitable vulnerability that could grant full control of the affected system.

A critical unauthenticated privilege escalation vulnerability exists in IBM Administration Runtime Expert (ARE) for i, allowing remote attackers to execute actions under another authenticated user's session. This flaw, rated 9.9 CVSS, poses severe risk to IBM i systems used for enterprise administration and automation, potentially enabling full system compromise without prior credentials.