CVE-2026-92913

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) uses a cryptographically weak PRNG in getRandomCode() (objects/functions.php), deriving account activation/login pairing codes from uniqid() with a single non-CSPRNG rand() character as padding, reducing the code space to ~2^25 valu...

CVE-2026-92913 AVideo Weak PRNG Activation Code Authentication Bypass

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode in objects/functions.php derives the code entirely from uniqid sprintf'%08x%05x', seconds, microseconds...

CVE-2026-92913 AVideo Weak PRNG Activation Code Authentication Bypass

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode in objects/functions.php derives the code entirely from uniqid sprintf'%08x%05x', seconds, microseconds...

EUVD-2026-81435

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode in objects/functions.php derives the code entirely from uniqid sprintf'%08x%05x', seconds, microseconds...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover vulnerability

Authenticated Custom+ Missing Authorization to Limited Account Takeover vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Amelia versions = 2.4.4...

Exploit for CVE-2026-67401

CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RC...

CVE-2026-86707 Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

CVE-2026-86707 Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

EUVD-2026-81339

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

Exploit for CVE-2026-12793

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-92920: Insufficient Session Expiration

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...

CVE-2026-54907: Initialization of a Resource with an Insecure Default

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

CVE-2026-92913: Use of Insufficiently Random Values

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode in objects/functions.php derives the code entirely from uniqid sprintf'%08x%05x', seconds, microseconds...

CVE-2026-92915: Allocation of Resources Without Limits or Throttling

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...

The vulnerability of the WSO2 platform for integrating application programming interfaces and web services lies in errors in cryptographic signatures. This allows attackers to gain unauthorized access and steal user accounts.

The vulnerability of the WSO2 platform for integrating application programming interfaces, applications, and web services is related to errors in verifying cryptographic signatures. Exploiting this vulnerability can allow an attacker to gain unauthorized access and control over user accounts...

CVE-2026-77614: Session Fixation

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mhdefaultorg.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does no...

CVE-2026-81637: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-88952: Improper Authentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action...

CVE-2026-63472: Improper Authentication

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...

CVE-2026-92984: Session Fixation

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the...