Vulnerability intelligence

CVE-2026-15826 is an authentication bypass vulnerability found in the User Profile Builder plugin for WordPress, affecting versions up to and including 3.16.4. This flaw allows unauthenticated attackers to log in as a site's administrator. The vulnerability stems from a bug within the plugin's registration and autologin process, specifically related to how WordPress core handles usernames exceeding 60 characters. Discovered by security researcher Supakiad S. (m3ez) and reported via Wordfence's Bug Bounty Program, this issue impacts over 40,000 WordPress sites, particularly those with the "Automatically Log In after Registration" setting enabled. A fix for this vulnerability is included in User Profile Builder version 3.16.5.

CVE-2026-59309 is an authentication bypass vulnerability found within the VMware Directory Service component of VMware vCenter Server. This flaw allows a malicious actor with network access to vCenter to bypass authentication mechanisms and gain unauthorized access to the system. Broadcom, the vendor, disclosed this vulnerability on July 29, 2026, as part of a broader security advisory. While the vulnerability enables unauthorized access, Broadcom has not publicly detailed the precise bypass mechanism or the specific privilege level an attacker might achieve after successful exploitation.

CVE-2026-73683 describes an authentication bypass vulnerability found in the Facebook provider of Laravel Socialite. This flaw allows unauthenticated attackers to replay captured OpenID Connect (OIDC) `id_tokens`. The vulnerability stems from a missing nonce claim validation within the `getUserByOIDCToken()` function in `FacebookProvider.php`. Attackers who obtain a valid, unexpired `id_token` issued for the same Facebook App ID can submit this token to the backend `userFromToken()` endpoint. This bypasses authentication controls because signature, audience (`aud`), and issuer (`iss`) checks pass, while no session-bound nonce comparison is performed, ultimately leading to unauthorized access to victim accounts.

CVE-2026-72898 describes a SQL Injection vulnerability found in Metabase, an open-source business intelligence platform. This flaw allows an unauthenticated remote attacker to inject arbitrary SQL commands into the Metabase application database. The vulnerability is specifically exploitable via the `/reset_password` database endpoint. Successful exploitation of this vulnerability can grant an attacker administrator access to the Metabase instance. With this elevated access, an attacker could potentially alter application configurations, exfiltrate stored credentials for any connected databases, read data accessible through those connections, and export data.

CVE-2026-68820 is identified as a "Use after free" vulnerability found within the Windows Ancillary Function Driver for WinSock. This flaw enables an authorized attacker to achieve local privilege escalation. The vulnerability was recognized as a zero-day exploit and was actively leveraged in attacks. Microsoft addressed CVE-2026-68820 as part of its August 2026 Patch Tuesday release.

CVE-2026-20349 is a vulnerability affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The flaw stems from insufficient error checking during the processing of HTTP requests. An unauthenticated, remote attacker can exploit this by sending a specially crafted HTTP request to the Remote Access SSL VPN service on an affected device. Successful exploitation of CVE-2026-20349 can cause the targeted appliance to reload, leading to a denial-of-service (DoS) condition. Cisco has released hotfixes to address this issue, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.