EUVD-2026-82689

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

CVE-2026-90976 Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...

CVE-2026-90976

The Clean Login WordPress plugin before version 1.19 contains a flaw in its registration handler: it does not verify whether user registration is enabled before creating an account. This allows unauthenticated users to create accounts on sites where registration has been disabled, resulting in a ...

WordPress Clean Login plugin < 1.19 - Unauthenticated Account Creation with Registration Disabled vulnerability

Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Artus KG in WordPress Plugin Clean Login versions 1.19...

CVE-2026-90976 Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...

CVE-2026-85123

The Easy Form Builder by WhiteStudio WordPress plugin, versions 4.0.0-4.1.3 , is vulnerable to an unauthenticated registration policy bypass . The flaw exists because the plugin fails to validate submitted values against stored configurations for certain form types, specifically involving Login F...

EUVD-2026-82666

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...

CVE-2026-85123 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...

CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

EUVD-2026-82605

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

EUVD-2026-82496

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated...

DEBIAN-CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

UBUNTU-CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

PT-2026-95661

Name of the Vulnerable Software and Affected Versions CordysCRM versions 1.7.0 through 1.7.3 Description An authenticated user with MODULE SETTING UPDATE permissions can execute arbitrary database functions via the POST /account-pool/page endpoint. This occurs because the...

PT-2026-95262

Name of the Vulnerable Software and Affected Versions Clean Login WordPress plugin versions prior to 1.19 Description The registration handler in the plugin fails to verify if user registration is enabled on the site. This allows unauthenticated users to create accounts even when the site...

PT-2026-95263

Name of the Vulnerable Software and Affected Versions Clean Login WordPress plugin versions prior to 1.19 Description The plugin fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass anti-automation controls on the registratio...

CVE-2026-56592: Improper Restriction of Excessive Authentication Attempts

HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...

PT-2026-95306

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description Cross-Site Scripting XSS allows an attacker to inject unsanitized malicious scripts that execute in a victim's browser. This can lead to session hijacking, account...