CVE-2024-6832: Protection Mechanism Failure

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

PT-2026-68438

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking...

CVE-2026-48087: Improper Authentication

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

CVE-2026-5430: Improper Verification of Cryptographic Signature

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this...

CVE-2026-16619: Improper Restriction of Excessive Authentication Attempts

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-1728: Improper Privilege Management

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...

PT-2026-68448

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description Tokens issued to low-privileged users lack sufficient restrictions, enabling them to be used to access product-level Admin REST APIs. An attacker with a low-privileged account and a val...

CVE-2026-48085: Missing Authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

PT-2026-68747

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.1 Description An issue exists where a fully provisioned instance accepts unauthenticated POST requests to the /setup/create-admin-account endpoint. The system creates additional GLOBAL ADMIN accounts without...

PT-2026-68749

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description The registration handler at the endpoint POST /api/auth/register/userId fails to validate that the userId provided in the URL corresponds to the email address associated with the registration...

CVE-2026-64665: Improper Authentication

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

PT-2026-75997

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has edit users permission which doesn’t allow changing...

PT-2026-68659

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

PT-2026-68770

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.1 Statamic versions prior to 6.24.0 Description When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker can sign in as an existing user, includin...

Malicious Package

Overview eth-account-wallet is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in multi-acct (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 395e9271172eea5db15a1090043ee564ad6b8564fb9e267faff883ac3c6af125 [email protected] is a near-empty wrapper index.js is a two-line stub returning name/version literals; author is the generic 'Package Registry' and...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date via the SavePasswordController::handle process. An attacker can gain unauthorized access to user accounts by submitting expired password reset tokens directly to the reset endpoint, bypassing the...

MAL-2026-13372 Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

CVE-2026-20028

A vulnerability in the network driver of Cisco Terminal Service TS Agent could allow an authenticated, remote attacker to bypass firewall rules that are associated with the account of the attacker. This vulnerability is due to an incorrect mapping of network connections to user accounts. An...

CVE-2026-20028

CVE-2026-20028 describes a vulnerability in Cisco Terminal Service (TS) Agent’s network driver that could allow an authenticated, remote attacker to bypass firewall rules tied to the attacker’s account. The issue stems from an incorrect mapping of network connections to user accounts, enabling an...