43167 matches found
EUVD-2026-90547
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...
CVE-2026-76143
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...
CVE-2026-76143
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter. The provided documents do not specify the exact affected version, the specific component or file involved, or the specific remediation steps....
EUVD-2026-90485
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...
Rocky Linux 10.2 [CIQ] Security Update: kbd / kbd-debuginfo / kbd-debugsource / kbd-legacy / kbd-misc (crlsa-2026_57597)
The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202657597 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...
Rocky Linux 9 [CIQ] Security Update: kbd / kbd-debuginfo / kbd-debugsource / kbd-legacy / kbd-misc (crlsa-2026_57610)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202657610 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...
AlmaLinux 9.2 [TuxCare] Security Update: kbd / kbd-legacy / kbd-misc (ALMALINUX9.2:CLSA-2026:1788600455)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788600455 advisory. - openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the...
PT-2026-103678
Name of the Vulnerable Software and Affected Versions Genian SSL PNS affected versions not specified Description A missing authorization issue in the public-facing VPN/ZTNA gateway allows an attacker to bypass multi-factor authentication MFA by manipulating a login request parameter. This could...
PT-2026-105913
Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...
CVE-2026-76143: Missing Authorization
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...
PT-2026-103717
Name of the Vulnerable Software and Affected Versions The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform versions prior to 2.15.1 Description An authentication bypass exists in the login customer after checkout function via the checkout form parameter. The issue occurs because the...
PT-2026-105818
Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Details python lightrag/api/lightrag server.py:2161 @app.post"/login" async def loginform data: OAuth2PasswordRequestForm =...
Rocky Linux 10.2 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_54178)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654178 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6...
PT-2026-103952
Name of the Vulnerable Software and Affected Versions Tapo C120 v1 Tapo C200 V5 Description Insufficient protection of login challenge data and lack of sanitization of attacker-controlled input processed by the MacTool handler allow an unauthenticated attacker on the same local network to replay...
PT-2026-103743
Name of the Vulnerable Software and Affected Versions WPC Shop as a Customer for WooCommerce versions prior to 2.0.1 Description This issue allows for privilege escalation via account takeover. An authenticated attacker can gain full Administrator-level access to a site by supplying an...
PT-2026-103714
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before email success msg function whitelisting the client-submitted 'role' key and copying it into the...
Rocky Linux 8 [CIQ] Security Update: irssi / irssi-debuginfo / irssi-debugsource / irssi-devel (crlsa-2020_1616)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20201616 advisory. irssi: use after free when sending SASL login to server CVE-2019-13045 Tenable has extracted the preceding description block directly from the CIQ security advisory...
Rocky Linux 8 [CIQ] Security Update: mailman / mailman-debuginfo / mailman-debugsource Multiple Vulnerabilities (crlsa-2021_1751)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211751 advisory. mailman: arbitrary content injection via the options login page CVE-2020-12108 mailman: arbitrary content injection via the private archive login page...
PT-2026-105184
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...