WordPress Login with OTP plugin <= 1.6 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Irwan Kusuma in WordPress Plugin Login With OTP versions = 1.6...

CVE-2024-57610

Lack of Rate Limiting in Sylius v2.0.2 Vendor Homepage: https://sylius.com/ Steps to Reproduce 1.Navigate to https://store.sylius.com/login 2.Attempt multiple login requests using automated tools or scripts e.g., Burp Suite, cURL. 3.Observe that no rate limiting is applied, and requests are...

CVE-2026-94218 Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication 2FA setup, through a client policy. A user can bypass this...

CVE-2026-94218

A flaw in Keycloak's authentication session management allows a user to bypass mandatory 2FA setup enforcement configured via a client policy. During the login process, manually visiting a specific session restart web link clears internal markers that track required security steps, letting the us...

CVE-2026-94215

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-94102

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The...

CVE-2026-94102

An open redirect vulnerability exists in WuzhiCMS up to 4.1.0 , specifically in the Login component at /index.php?m=member&v=Login. The root cause is that the forward argument is only sanitized by remove_xss(), an XSS keyword/entity scrubber, which is insufficient to prevent a crafted redirect UR...

CVE-2026-94102 WuzhiCMS Login index.php redirect

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The...

CVE-2026-94102 WuzhiCMS Login index.php redirect

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The...

EUVD-2026-83814

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The...

CVE-2026-94102: URL Redirection to Untrusted Site

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The...

PT-2026-96251

Name of the Vulnerable Software and Affected Versions Sync-in Server versions prior to 2.4.1 Description An observable timing discrepancy exists in the login process. When an authentication attempt is made for a nonexistent account, the system returns a response immediately without performing the...

PT-2026-96094

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The login function in UsersController.php contains insufficient HTTP method validation. The system uses an allowlist that only checks for POST and PUT methods before applying security controls. An...

CVE-2026-94379: Improper Input Validation

The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...

PT-2026-96162

Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.0 Description An unauthenticated remote attacker can trigger a global login lockdown by sending POST requests to the '/api/user/login' endpoint using 257 distinct nonexistent usernames. This occurs because the...

PT-2026-96021

Name of the Vulnerable Software and Affected Versions WuzhiCMS versions prior to 4.1.1 Description A flaw in the Login component allows for an open redirect, which occurs when a user is unexpectedly redirected to an external site. This issue is triggered by the manipulation of the forward argumen...

CVE-2026-77561: Improper Restriction of Excessive Authentication Attempts

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

PT-2026-96142

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1 Description A flaw in the ValidateOAuthState function allows an unauthenticated attacker to bind a victim's session to an attacker-controlled OAuth identity. This occurs because the system clears the oauth stat...

CVE-2026-58272: Observable Timing Discrepancy

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

CVE-2026-93980 code-projects Internship Management System Admin Login Form login.php sql injection

A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Admin Login Form. Executing a manipulation of the argument Password can lead to sql injection. The attack may be performed from...