CVE-2026-86184 Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered emai...

EUVD-2026-71993

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered emai...

CVE-2026-86184 Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered emai...

CVE-2026-86184 Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered emai...

CVE-2026-86184

Lara Dashboard before 1.3.0 is affected by an authentication bypass in the screenshot-login route. When APP_ENV is not set to production, an unauthenticated attacker can request GET /screenshot-login/{email} with any registered email address to obtain a fully authenticated session. This grants ac...

CVE-2026-83628

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

EUVD-2026-71840

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

CVE-2026-83628 Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

CVE-2026-83628 Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

CVE-2026-83628

Theme My Login plugin for WordPress (versions

SUSE CVE-2026-42350

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2...

SUSE CVE-2026-67437

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...

VulnCheck KEV: CVE-2026-86060

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation...

PT-2026-86409

Name of the Vulnerable Software and Affected Versions Lara Dashboard versions prior to 1.3.0 Description An authentication bypass exists in the screenshot-login route when the APP ENV variable is not set to production. Unauthenticated attackers can access the GET '/screenshot-login/email' endpoin...

PT-2026-86313

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tml ms signup handler function's gimmeanotherblog branch failing to enforce the network's active signup registration policy,...

PT-2026-86330

🚨 CVE-2026-77826 The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and l...

CVE-2026-77826: Improper Authentication

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

CVE-2026-86060: Improper Neutralization of Argument Delimiters in a Command

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS...

CVE-2026-83628: Missing Authorization

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

CVE-2026-86184: Missing Authentication for Critical Function

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered emai...