PT-2026-67110

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

PT-2026-67341

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

📄 osTicket 1.18.3 Authentication Bypass Account Takeover

A proof of concept exploit for an osTicket version 1.18.3 authentication bypass account takeover vulnerability. osTicket versions 1.17.8 through 1.18.3 contain a flaw in PasswordResetTokenBackend::signOn where the password reset expiration check is incorrectly guarded by a short-circuiting logica...

CVE-2026-16565: Authorization Bypass Through User-Controlled Key

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...

PT-2026-67427

Name of the Vulnerable Software and Affected Versions 389 Directory Server affected versions not specified Description An issue exists during SASL PLAIN authentication where the server installs connection-level bind credentials before verifying if the account is locked. If the account is locked,...

CVE-2026-69082: Cross-Site Request Forgery (CSRF)

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

Linux Distros Unpatched Vulnerability : CVE-2026-18651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the...

CVE-2026-18577

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1...

CVE-2026-18577

CVE-2026-18577 concerns an authentication bypass in N-able N-central resulting from an incomplete patch for CVE-2026-18556. Affected builds include versions through 2026.3.1, with N-able releasing hotfix 2026.3.1.7 to address the issue. Multiple connected sources note that attackers could gain re...

CVE-2026-18577 Incomplete patch leads to administrative account takeover

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1...

CVE-2026-18577

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1...

GHSA-9JRX-VMH8-C6XW Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vvcv-vpph-h844. This link is maintained to preserve external references. Original Description Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs a...

Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vvcv-vpph-h844. This link is maintained to preserve external references. Original Description Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs a...

CVE-2026-16261

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as a...

CVE-2026-16256

The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new...

CVE-2026-12586

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user including an administrator and take over the account...

CVE-2026-15236

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account...

CVE-2026-16261 Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as a...

CVE-2026-16261

The login-social (also known as Huge IT Login ) WordPress plugin, version 1.0.4 and below , is vulnerable to an unauthenticated account takeover . The root cause is a failure to validate password-reset requests against a specific reset key or the requester's identity. Additionally, the plugin iss...

CVE-2026-16261

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as a...