NVD disclosure day

Published threat advisories for October 27, 2026

CVE-2026-92885

Qode Membership WordPress Plugin Authentication Bypass Vulnerability

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A vulnerability exists in the Qode Membership WordPress plugin that allows unauthenticated attackers to bypass login and take over any user account, including administrators. This is due to an error in the Facebook login verification process that allows attackers to log in using a known username and a nonce obtainable

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2026-18450

BMC IPMI Command Execution Vulnerability.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

A Baseboard Management Controller (BMC) vulnerability allows attackers to execute arbitrary commands by bypassing integrity and encryption checks for IPMI commands. This could impact system control and operational integrity if affected systems are reachable.

NVD modified: NVD date unavailable