CVE-2026-77508

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/username/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the...

osint-tools-mcp-server

🔍 OSINT उपकरण MCP सर्वर एक व्यापक MCP सर्वर जो AI सहायकों जैसे Claude को कई OSINT उपकरणों तक पहुँच प्रदान करता है। यह सर्वर AI को उद्योग-मानक OSINT उपकरणों का उपयोग करके परिष्कृत टोही और सूचना संग्रह कार्य करने की अनुमति देता है। 🛠️ उपलब्ध उपकरण 🔍 Sherlock - उपयोगकर्ता नाम खोज 399+ सोशल मीडिया...

CVE-2024-24139

CVE-2024-24139: Система входа с проверкой электронной почты SQL-инъекция Доказательство концепции PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24139.md Доказательство концепции PoC : https://github.com/BurakSevben/CVE-2024-24139/blob/main/CVE-2024-24139.md...

gitlab-exploit

gitlab-exploit GitLab CVE-2023-7028 GitLab CVE-2023-7028 この脆弱性は、パスワードリセット時のメール検証の処理方法に起因するバグによって発生しました。攻撃者はパスワードリセットリクエスト時に2つのメールアドレスを提供し、リセットコードが両方のアドレスに送信される可能性がありました。これにより、攻撃者はユーザーの現在のパスワードを知らなくても、任意のユーザーのパスワードをリセットできました。 影響を受けるバージョン 以下のバージョンを使用するGitLab CE/EEの全インスタンスが影響を受けました： 16.1 ～ 16.1.5 16...

poastal

Poastal - a ferramenta OSINT de Email Poastal é uma ferramenta OSINT de e-mail que fornece informações valiosas sobre qualquer endereço de e-mail. Com o Poastal, você pode facilmente inserir um endereço de e-mail e ele responderá rapidamente a várias perguntas, fornecendo informações cruciais. ✨...

mosint

Features • Installation • Services • Usage • Docker • Config • Screen Mosint is an automated email osint tool written in Go that allows you investigate for target emails in a fast and efficient manner. It consolidates numerous services, enabling security researchers to swiftly access a wealth of...

anti-anti-automation

Anti-Anti-Automation Framework Ein Framework für Techniken zur Umgehung gängiger Sicherheitskontrollen gegen Automatisierung. Häufige Anti-Automatisierungs-Kontrollen E-Mail-Verifizierung CAPTCHA SMS/Telefon Kreditkarte WASC-21: Unzureichende Anti-Automatisierung...

EUVD-2026-36714

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak-Reset-Credentials-Bypass → Kontenübernahme Unauthentifizierte Kontenübernahme im Reset-Credentials-Ablauf von Keycloak. Ein Angreifer, der nur einen Benutzernamen/eine E-Mail-Adresse kennt, kann das Passwort eines beliebigen Benutzers zurücksetzen — einschließlich...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

CVE-2021-34646

CVE-2021-34646 PoC Détail de la vulnérabilité par NVD Les versions jusqu'à et y compris la 5.4.3 du plugin Booster for WooCommerce pour WordPress sont vulnérables à un contournement d'authentification via la fonction processemailverification en raison d'une faiblesse dans la génération de jetons...

CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

EUVD-2026-64224

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-14861

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-14861 User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-14861 User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-44472

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

VulnCheck KEV: CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...