54412 matches found
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...
GHSA-6J36-R6PR-59X4 Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...
CVE-2026-63472 Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...
EUVD-2026-81668
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...
CVE-2026-63472
Vendure , an open-source headless commerce platform, is vulnerable to account takeover via its external authentication system. In ExternalAuthenticationService.createCustomerAndUser, an existing customer is matched by email address alone and a new external authentication method is attached withou...
CVE-2026-63472 Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...
CVE-2026-63472 Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...
CVE-2026-85500
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by...
CVE-2026-88952
AshAuthentication (team-alembic, an Elixir authentication library) contains an improper authentication flaw in its OAuth2 sign-in flow. The UserResolver.resolve/3 function matches an existing account via upsert_identity keys but gates the link solely on the provider's email_verified boolean, neve...
CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by...
CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by...
CVE-2026-92915 WWBN AVideo userVerifyEmail.php Unauthenticated Access Control
WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...
WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability
Email Verification Bypass vulnerability discovered by Ahmed Embaby in WordPress Plugin FluentAuth – The Ultimate Authorization & Security Plugin for WordPress versions = 2.1.2...
CVE-2026-78296 WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability
Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/a through 2.1.2...
CVE-2026-78296
CVE-2026-78296 affects WP ManageNinja LLC's FluentAuth WordPress plugin (versions up to 2.1.2 ). The vulnerability is classified as Insufficient Verification of Data Authenticity , which allows Identity Spoofing through the plugin's email verification mechanism. The CVSS 3.1 score is 5.3 (MEDIUM)...
CVE-2026-78296 WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability
Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/a through 2.1.2...
net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...
CVE-2026-87836
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...
CVE-2026-87836
The Comments Import & Export WordPress plugin versions 2.1.11 through 2.5.3 is vulnerable to an unauthorized information disclosure. The plugin fails to restrict comment exports to users with moderation capabilities or scope them to content owned by the requesting user. This allows users with the...