CVE-2026-16261

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as a...

CVE-2026-12586

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user including an administrator and take over the account...

CVE-2026-16261

The CVE concerns the WordPress plugin login-social (v1.0.4) which does not validate password-reset requests against a reset key or the requester’s identity. It issues authentication sessions from unverified third‑party sign‑in data, enabling unauthenticated attackers to either reset any user’s pa...

CVE-2026-16261

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as a...

CVE-2026-16261 Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as a...

CVE-2026-12586

The Lenxel WP WordPress theme (up to version 1.0.31) allows unauthenticated password resets by validating only a CSRF nonce, with no authorization or ownership check on the password-reset action. The underlying issue is a missing access control for the reset endpoint, enabling attackers to reset ...

CVE-2026-12586

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user including an administrator and take over the account...

CVE-2026-15206 SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

CVE-2026-15206

The CVE concerns the SMS Alert WordPress plugin (versions before 3.9.8). The vulnerability arises because the plugin does not bind the user’s real verified mobile session to the verified phone number; after OTP verification, the signup/login handler uses an attacker-supplied phone number to selec...

Apache StreamPipes <= 0.93.0 - Use of Cryptographically Weak PRNG in Recovery Token Generation

Apache StreamPipes from version 0.69.0 through 0.93.0 uses a cryptographically weak Pseudo-Random Number Generator PRNG in the recovery token generation mechanism. Given a valid token it's possible to predict all past and future generated tokens. id: CVE-2024-29868 info: name: Apache StreamPipes ...

ClinicCases 7.3.3 Cross-Site Scripting

ClinicCases 7.3.3 is susceptible to multiple reflected cross-site scripting vulnerabilities that could allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft. id: CVE-2021-38704 info: name:...

WWBN AVideo 11.6 - Cross-Site Scripting

A reflected XSS vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff, allowing arbitrary Javascript execution. id: CVE-2023-48728 info: name: WWBN AVideo 11.6 - Cross-Site Scripting author: ritikchaddha severity: medium...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

Flowise <= 3.0.5 - Account Takeover

Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts. id: CVE-2025-58434 info: name: Flowise = 3.0.5 - Account Takeover author:...

CVE-2026-18556 Unauthenticated administrative account takeover

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1...

CVE-2026-67333

better-auth before 1.6.13 and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3 fail to validate the scheme of redirecturis registered via the deprecated oidc-provider plugin and the mcp plugin which wraps the same provider. An attacker can register an OAuth client with a javascript:...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67330

@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...

CVE-2025-71403

The CVE-2025-71403 entry concerns better-auth versions prior to 1.1.20, where a bypass in trustedOrigins validation logic affects absolute URLs and wildcard domains. This enables an attacker to craft malicious callbackURL parameters that bypass origin checks and trigger open redirects, potentiall...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...