CVE-2026-72699: Observable Discrepancy

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-72697: Improper Limitation of a Pathname to a Restricted Directory

Grav CMS before 2.0.16 contains a path traversal vulnerability in the mediadirectory Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem...

PT-2026-82020

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder...

CVE-2026-75465

The Maccms v10 v2026.1000.4055 software is vulnerable to an Incorrect Access Control issue in the /api.php/user/get_list endpoint. The interface fails to implement any authentication or authorization checks, allowing an unauthenticated remote attacker to send a crafted HTTP GET request. By manipu...

PT-2026-81862

Name of the Vulnerable Software and Affected Versions Maccms version v2026.1000.4055 Description The '/api.php/user/get list' endpoint is subject to Incorrect Access Control, which occurs when an application fails to properly restrict access to sensitive data or functions. The interface does not...

PT-2026-81912

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username...

PT-2026-81147

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

PT-2026-81225

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A remote, unauthenticated attacker can exploit the way the extension handles the search query parameter passed to Apache Solr. Because advanced Solr query...

JetBrains TeamCity < 2021.1.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2021.1.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. CVE-2021-43193 - In JetBrains TeamCity before...

CVE-2026-75465

The /api.php/user/getlist endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters t...

CVE-2026-78551

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-78551

RansomLook 's /login endpoint contained two distinct authentication weaknesses exploitable by an unauthenticated remote attacker. First, a timing-based username enumeration was possible because the password hash verification function was only invoked for existing accounts, producing measurably di...

CVE-2026-78551

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

CVE-2026-78551 RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

CVE-2026-78551 RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

EUVD-2026-65085

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...