Authentication bypass in Felan Framework WordPress plugin versions up to 1.1.4 enables unauthenticated attackers to impersonate any user account registered via Facebook or Google social login. Hardcoded passwords in fb_ajax_login_or_register and google_ajax_login_or_register functions allow complete account takeover of affected users without requiring credentials. Exploitable remotely without user interaction. CVSS 9.8 Critical severity. No public exploit identified at time of analysis.
Denial of service in the Qt cross-platform application framework's Windows Schannel TLS backend (CWE-459 incomplete cleanup) lets remote attackers gradually exhaust resources by repeatedly driving TLS connections, degrading availability over a long period. It affects all Qt applications on Windows using the native Schannel TLS provider from Qt 5.15.0 through 6.8.3 and 6.9.0 through 6.9.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor rates it CVSS 4.0 9.2 (Critical), driven largely by a debatable subsequent-system availability impact.