44452 matches found
CVE-2026-13690
The UsersWP WordPress plugin (versions before 1.2.67 ) contains a two-factor authentication bypass vulnerability. The flaw exists because the plugin fails to validate the selected authentication provider within its two-factor login handler. This allows an attacker who possesses a user's primary c...
CVE-2026-13690
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...
CVE-2026-17166
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...
PT-2026-65789
Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...
PT-2026-65844
Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Management Center affected versions not specified Description The web interface contains static user credentials for a low-privileged account. An unauthenticated remote attacker can use these hard-coded credentials to log...
PT-2026-65706
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service...
PT-2026-65693
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...
PT-2026-65740
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the administrative API used to manage identity providers and organizations. An administrator with permissions to manage identity providers can link a new provider to an...
CVE-2026-14300: Improper Authentication
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...
CVE-2026-13690: Improper Authentication
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...
CVE-2026-66400: Insufficient Session Expiration
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...
PT-2026-65697
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...
ROS-20260729-73-0031
The vulnerability of the password blocking mechanism MAXLOGINATTEMPS of the pgAdmin 4 database management tool is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to...
CVE-2026-63235: Improper Access Control
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service...
PT-2026-65805
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...
VulnCheck KEV: CVE-2026-20316
Cisco Secure Firewall Management Center FMC formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the...
CVE-2026-59243: Improper Verification of Cryptographic Signature
The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...
CVE-2026-67437: Uncontrolled Resource Consumption
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...
Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091
An advisory for this issue has been issued at https://www.drupal.org/sa-contrib-2026-110 and an additional issue was identified and fixed via https://www.drupal.org/sa-contrib-2026-111 This module is now resupported. See that advisory for more details. Original content The security team is markin...
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Cisco Secure Firewall Management Center FMC formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the...