PT-2026-79009

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

ALSA-2026:57610 Moderate: kbd security update

The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files. Security Fixes: kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-726...

RHEL 10 : kbd (RHSA-2026:57597)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57597 advisory. The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font...

PT-2026-78958

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

RHEL 9 : kbd (RHSA-2026:57610)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57610 advisory. The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font...

CVE-2026-54739

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

CVE-2026-76574

A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be...

CVE-2026-54739 Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

CVE-2026-54739 Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

EUVD-2026-62847

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

CVE-2026-54739 Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...

CVE-2026-76574

code-projects Hospital Information System 1.0 contains a SQL injection vulnerability in the User::login function within includes/users/UsersController.php (User Login Handler component). Manipulation of the email argument allows a remote, unauthenticated attacker to inject SQL commands. The CVSS ...

CVE-2026-76574 code-projects Hospital Information System User Login UsersController.php login sql injection

A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be...

EUVD-2026-62836

A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be...

CVE-2026-76574 code-projects Hospital Information System User Login UsersController.php login sql injection

A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be...

CVE-2026-62671

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer...

CVE-2026-62669

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-53654

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2026-64852 Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user c...

CVE-2026-62671 CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer...