CVE-2026-83356

The Qode Membership plugin for WordPress in versions up to and including 2.0.6.2 contains a typographic error in the Facebook OAuth token verification guard ($check_social_useqoder instead of $check_social_user). This causes the guard condition to always evaluate true, rendering the Graph API token verification dead code and allowing unauthenticated attackers to log in as any account, including Administrator, by supplying a login name in the response[email] parameter.

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow in function sub_402340 of infostat.cgi (Device-Information CGI component). Manipulating the CONTENT_LENGTH argument causes overflow, and the exploit is publicly available.

In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the apmib_set function in firewall.so is vulnerable to command injection. The vulnerability can be exploited remotely, and a public exploit is available.

In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the getDeviceInfo function in /var/lib/misc/udhcpd.leases is vulnerable to command injection via manipulation of the MAC address argument. The attack can be launched remotely, and the exploit is publicly available.

In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setCloudUpgradeFW function in lib/cste_modules/upgrade.so is vulnerable to command injection via manipulation of the FileName argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules. This may allow an attacker to obtain elevated Consul privileges.

There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with service access privileges to issue database-specific functions that should not be allowed.

A vulnerability in the Burrito Kubernetes operator (Terraform Automation Collaboration Software) prior to 0.13.0 allows the POST /api/webhook endpoint to accept unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value. Anyone who can reach the burrito-server endpoint and knows a tracked repository's URL can forge events to create or delete TerraformPullRequest custom resources with attacker-chosen Branch, Base, and ID fields. For GitHub pull_request events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch, potentially causing an unauthorized terraform plan using the operator's stored git and cloud credentials.

Through 9.0.4, the Rust zip library's ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata. A crafted archive can appear benign to a component inspecting the central directory but cause a streaming extractor to write a different attacker-selected path and content.