CVE-2026-49767

criticalpriority · track · 0OT risk · elevatedEPSS 0.005 · 46 %ileEU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.55% (46th) EPSS

CVSS 9.8 · critical

Is it mine?

1 products

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · scored 2026-10-27

Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · audit@patchstack.comexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

The CWE weakness classes this flaw belongs to.

Products and version ranges known to be affected.

Other names and identifiers for this entity.

Which sources assert this record, and when.

published 2026-06-17modified 2026-10-26

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-19490US	critical9.8OT critical	32.7% (98th)	KEV	2026-08-19
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 t…
CVE-2026-18577US	high8.1OT critical	14.6% (97th)	KEV	2026-08-02
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
CVE-2026-18556US	high7.4OT critical	7.88% (95th)	KEV	2026-08-01
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.
CVE-2026-20079US	—OT critical	88.5% (100th)	KEV	2026-03-04
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute…
CVE-2026-1603US	high7.5OT critical	88.3% (100th)	KEV	2026-02-10
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.