CVE-2026-105804 Payload: Password hashes use insufficient PBKDF2 iterations

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test...

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

Summary This is the same bug as Django had CVE-2013-1443. Details A long password can cause a DoS because it is not using cached HMAC, length limits, or pre-hashing passwords longer than the block size of the hash function as per HMAC spec. This line of code hashes the full password each iteratio...

CVE-2026-94206 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 is a CVSS 8.8 High Authenticated Agent+ Privilege Escalation vulnerability in the LatePoint – Calendar Booking Plugin CVE-2026-6741 — LatePoint Privilege Escalation Scanner Plugin: LatePoint – Calendar Booking Plugin for Appointments and Events latepoint CVE ID:...

CVE-2026-105703

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...

EUVD-2026-92938

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...

CVE-2026-105703 PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...

CVE-2026-105703

The PHPGurukul User Registration & Login and User Management System 3.3 is vulnerable to an incorrect authorization flaw within the Change Password Handler component. Specifically, an unknown function in the file loginsystem/admin/change-password.php fails to properly validate the currentpassword...

Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

DEBIAN-CVE-2026-92821

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

UBUNTU-CVE-2026-92821

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

EUVD-2026-92806

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password...

CVE-2026-105785

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

CVE-2026-92821

A vulnerability exists in SSSD where improper configuration allows an access control bypass in LDAP environments. If the system is configured to evaluate password expiration warnings before restrictive access rules, an expired-password warning causes the rule evaluation to terminate early, treati...

EUVD-2026-92894

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

CVE-2026-92821 Sssd: sssd: access control bypass via premature ldap access rule evaluation

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

CVE-2026-92821

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

CVE-2026-105785: Unverified Password Change

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

CVE-2026-92821: Return of Wrong Status Code

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

CVE-2026-105804: Use of Password Hash With Insufficient Computational Effort

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test...