CVE-2026-93949
Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows P
CVSS
7.1
High
EPSS
0.2%
p15
KEV
—
Exploit Today
4
0-100
Published: Oct 10, 2026 · Last modified: Oct 13, 2026 · CWE-288
0.2%EPSS · 30 days0.2%
2026-10-102026-10-23
Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-7985010.0 CRI33.1%
——10No description provided19hCVE-2026-7984410.0 CRI33.1%
——10No description provided19hCVE-2026-1147326.8 MED28.4%
——9Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.2dCVE-2026-963873.8 LOW9.5%
——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.1dCVE-2026-963856.5 MED10.7%
——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.1dCVE-2026-84923—15.8%
——5Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.2d