CVE-2026-49826 Concourse login flow has an open redirect issue

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

CVE-2026-19834 Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...

GO-2024-2598 vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager, nfs-subdir-external-provisioner, delve, docker-cli, nri-mongodb, yam, kyverno-policy-reporter-kyverno-plugin, flux-image-automation-controller, yq, secrets-store-csi-driver-provider-aws, nri-memcached, doppler-kubernetes-operator,...

CVE-2026-19297 Insufficient Authentication Brute Force Protection on Login Endpoint

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts...

CVE-2026-19297 Insufficient Authentication Brute Force Protection on Login Endpoint

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts...

CVE-2026-19297

IBM Langflow OSS 1.0.0–1.9.6 is affected by CVE-2026-19297 due to CWE-307: insufficient restriction of excessive authentication attempts, enabling a remote attacker to obtain unauthorized access to user accounts. The IBM Security Bulletin notes a rate-limiting mechanism for POST /api/v1/login, co...

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

CVE-2026-73655

Trigger.dev prior to 4.5.2: addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring email_verified. When existingEmailUser && !existingUser is true, the flow writes th...

CVE-2026-28185

Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...

WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Log in with Google versions = 1.4.2...

WordPress 7.0.2 Cross Site Scripting Checker

A vulnerability checker for a pre-authentication reflected cross site scripting vulnerability in WordPress version 7.0.2. The issue occurs in username handling on failed login attempts and can potentially be chained with administrator interaction and additional functionality to achieve code...

...[ More ]

n8n versions through 2.31.4 and version 2.32.0 contain an authentication bypass vulnerability in Token-Exchange embed login that can allow an attacker possessing a private key trusted by the target configuration to assume an existing user's account. The vulnerable email fallback path trusts an...

CVE-2026-46688 Meeting Room Booking System has an unauthenticated open redirect

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...

EUVD-2026-57700

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...

Security Bulletin: Insufficient Authentication Brute Force Protection on Login Endpoint

Summary A rate limiting capability exists within the product to restrict the number of authentication attempts permitted per IP address per minute against the login endpoint POST /api/v1/login. This control is configurable via the LANGFLOWRATELIMITENABLED environment variable, which defaults to...

CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

EUVD-2026-57429

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

CVE-2026-73306

Budibase (open-source low-code platform) is vulnerable prior to version 3.39.25 due to the login flow at POST /api/global/auth/:tenantId/login. The failure counter was incremented only for existing users, while emailLockout logic in packages/worker/src/middleware/emailLockout.ts surfaced X-Accoun...

CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...