A critical vulnerability in Privasys RA-TLS clients before version 0.5.0 allows attackers to relay enclave quotes, bypassing session binding checks in Rust and Go implementations.
Microsoft rates CVE-2026-83943 as high severity with an 8.7 CVSS score, warning that unauthorized actors can disclose sensitive information over a network.
An unauthenticated brute-force flaw in PHPNuxBill’s password reset flow allows attackers to hijack accounts by guessing 6-digit codes without limits.
The NVD rates CVE-2026-62046 as critical, noting that untrusted data deserialization allows object injection in Gutentype versions up to 2.1.12.
A commented-out security check in the 3D Product Configurator plugin allows attackers to execute arbitrary code on WordPress servers without logging in.
The open-source task manager Vikunja fixed a high-severity flaw where plaintext tokens in the database allowed attackers to hijack accounts without passwords.
Unauthenticated attackers can bypass security checks in Blocksy Companion to gain seller privileges and publish content on WordPress sites.
Unauthenticated visitors inject scripts via comment metadata that execute when moderators review entries in the Contao CMS backend interface.