CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab...

CVE-2026-14873

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-14873 Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-14873

The Bulk Password Reset plugin for WordPress is affected in all versions up to and including 1.3.3 by a privilege escalation vulnerability. The plugin fails to properly validate a user's identity before updating account details, allowing an authenticated attacker with subscriber-level access or a...

EUVD-2026-75241

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

PT-2026-89381

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit c3edcc274c389816d434acadac07ee78eaf330c1 Description A cross-site request forgery CSRF issue exists in the LoginControl plugin. The PGP key endpoints do not validate CSRF tokens, allowing attackers to use...

CVE-2026-88870: Cross-Site Request Forgery (CSRF)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a...

PT-2026-89354

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

PT-2026-89367

Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

PT-2026-89656

Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully...

CVE-2026-9161: Observable Response Discrepancy

Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-36392

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

CVE-2026-36392

FairSketch Rise CRM (versions

PT-2026-89649

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

CVE-2026-36392

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

CVE-2026-36392: Improper Neutralization of Input During Web Page Generation

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

CVE-2026-14873: Missing Authorization

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-88282: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

CVE-2026-88875: Exposure of Private Personal Information to an Unauthorized Actor

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...