CVE-2026-19660

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to and including 2.3.0. The revert_switch handler trusts the attacker-controlled original_user_id cookie as the privileged identity, and the nonce and capability check is performed on that cookie instead of the actual requester.

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path could cause clients to accept an unauthorized member into the end-to-end encrypted media session.

In 389-ds-base, the server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS. An on-path attacker can inject a crafted LDAP message that is processed after the TLS upgrade, and the response is delivered to the client instead of the client's own pending operation's response.

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. They can poison segment descriptors or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. They can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.

A use of hard-coded cryptographic key vulnerability in Johnson Controls EasyIO FS32 allows retrieval of embedded sensitive data. This issue affects EasyIO FS32 versions before 3.0b63.

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) contain hardcoded passwords in access control. Remote unauthenticated attackers can read them from firmware or documentation and access/reconfigure the robots.

Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) have unvalidated pathnames in the web interface. Remote unauthenticated attackers can use path traversal to read configuration and security parameters.

In GetSimple CMS CE prior to version 1.5, the UpdateCE update form lacked an anti-CSRF token and the POST handler did not verify token or request origin. A remote attacker can host a page that auto-submits a forged POST; when an authenticated admin visits it, the server performs an attacker-directed download-and-deploy operation, leading to remote code execution. The url field is also written unescaped, allowing HTML injection.