CVE Notifier

CVE-2026-92082 CWE-307 N/A

Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For…

cve.org Payara:Payara · Server 15 Sep 2026

CVE-2026-90650 CWE-79 7.2

MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'

The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to insufficient input sanitization an…

Wordfence jetmonsters:MotoPress · Hotel · Booking 15 Sep 2026

CVE-2026-16141 CWE-798 8.1

OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defa…

cve.org OpenBMC:phosphor-net-ipmid 15 Sep 2026

CVE-2026-16140 CWE-863 8.8

OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1

OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity…

cve.org OpenBMC:phosphor-net-ipmid 15 Sep 2026

CVE-2026-77179 CWE-59 N/A

Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the sha…

cve.org Docker:Docker · Sandboxes 15 Sep 2026

CVE-2026-15609 CWE-79 6.4

Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute

The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient…

Wordfence QODE:Bridge · - · Creative 15 Sep 2026

CVE-2026-14805 CWE-269 8.8

Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint…

Wordfence StylemixThemes:Consulting · - · Business, 15 Sep 2026

CVE-2026-92079 CWE-? N/A

Mitigation bypass in the Widget: Win32 component

Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

cve.org Mozilla:Firefox · Mozilla:Thunderbird 15 Sep 2026

CVE-2026-92078 CWE-? N/A

Denial-of-service in the Security component

Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

cve.org Mozilla:Firefox · Mozilla:Thunderbird 15 Sep 2026

CVE-2026-92077 CWE-? N/A

Denial-of-service in the SVG component

Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

cve.org Mozilla:Firefox · Mozilla:Thunderbird 15 Sep 2026

CVE-2026-92076 CWE-? N/A

Incorrect boundary conditions in the Networking component

Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

cve.org Mozilla:Firefox · Mozilla:Thunderbird 15 Sep 2026

CVE-2026-92075 CWE-? N/A

Mitigation bypass in the Networking component

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

cve.org Mozilla:Firefox · Mozilla:Thunderbird 15 Sep 2026