43198 matches found
CVE-2026-13639
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...
EUVD-2026-82774
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...
CVE-2026-13639
Synology DiskStation Manager (DSM) before versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 is affected by an insufficient entropy vulnerability in its login logic . A remote, unauthenticated attacker can leverage this flaw to read or write arbitrary files and conduct denial-of...
CVE-2026-13639
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...
WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force vulnerability
Unauthenticated Account Takeover via Password Reset Code Brute Force vulnerability discovered by ryan fabella in WordPress Plugin Login/Signup Popup versions 4.0.2...
CVE-2026-90976
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...
CVE-2026-90977
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...
CVE-2026-86800
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...
WordPress Login with QR plugin <= 1.0.0 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Login with QR versions = 1.0.0...
CVE-2026-18317 Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...
CVE-2026-90977
The Clean Login WordPress plugin prior to version 1.19 fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving the CAPTCHA. The vulnerabili...
CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...
CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...
EUVD-2026-82689
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...
CVE-2026-90976
The Clean Login WordPress plugin before version 1.19 contains a flaw in its registration handler: it does not verify whether user registration is enabled before creating an account. This allows unauthenticated users to create accounts on sites where registration has been disabled, resulting in a ...
EUVD-2026-82688
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...
CVE-2026-90976 Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...
CVE-2026-90976 Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...
WordPress Clean Login plugin < 1.19 - Unauthenticated Account Creation with Registration Disabled vulnerability
Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Artus KG in WordPress Plugin Clean Login versions 1.19...
CVE-2026-86800 WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...