CVE-2026-72780: Authentication Bypass by Capture-replay

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

CVE-2026-72772: Weak Password Recovery Mechanism for Forgotten Password

n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...

Linux Distros Unpatched Vulnerability : CVE-2026-72693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init...

WordPress XSS2Shell 4.7.0 < 4.7.34 / 4.8.0 < 4.8.29 / 4.9.0 < 4.9.30 / 5.0.0 < 5.0.26 / 5.1.0 < 5.1.23 / 5.2.0 < 5.2.25 / 5.3.0 < 5.3.22 / 5.4.0 < 5.4.20 / 5.5.0 < 5.5.19 / 5.6.0 < 5.6.18 / 5.7.0 < 5.7.16 / 5.8.0 < 5.8.14 / 5.9.0 < 5.9.14 / 6.0.0 < 6.0.13 / 6.1.0 < 6.1.11 / 6.2.0 < 6.2.10 / 6.3.0 < 6.3.9 / 6.4.0 < 6.4.9 / 6.5.0 < 6.5.9 / 6.6.0 < 6.6.6 / 6.7.0 < 6.7.6 / 6.8.0 < 6.8.7 / 6.9.0 < 6.9.6 / 7.0.0 < 7.0.3 Login Screen XSS

The version of WordPress installed on the remote host is 4.7.x prior to 4.7.34, or 4.8.x prior to 4.8.29, or 4.9.x prior to 4.9.30, or 5.0.x prior to 5.0.26, or 5.1.x prior to 5.1.23, or 5.2.x prior to 5.2.25, or 5.3.x prior to 5.3.22, or 5.4.x prior to 5.4.20, or 5.5.x prior to 5.5.19, or 5.6.x...

CVE-2026-72902

Dokploy (PaaS) vulnerability CVE-2026-72902 affects version prior to 0.29.13. An authenticated user can run arbitrary commands on a local/SSH target because registry.ts interpolates the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This is fixed in ...

CVE-2026-72902

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core

TL;DR: CVE-2026-64638, dubbed XSS2Shell, is a high-severity WordPress Core vulnerability that begins as a pre-authentication reflected XSS on the login screen and can be chained to PHP code execution when a logged-in administrator is successfully targeted. WordPress fixed the issue in 7.0.3 and...

CVE-2026-66405

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products...

CVE-2026-64940

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2026-66405

The CVE-2026-66405 entry concerns DEEBOT PRO M1 and DEEBOT PRO K1VAC where telnet servers remain enabled (telnet service may be used to log in). Connected sources confirm multiple vulnerabilities in these models and related ECOVACS app; the telnet issue is explicitly called out (CVE-66405). Root ...

CVE-2026-66405

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products...

CVE-2026-66405

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products...

EUVD-2026-55112

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products...

CVE-2026-18470

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

CVE-2026-64940

CVE-2026-64940 pertains to Tegalog -Fumy Otegaru Memo Logger- from Nishishi Factory. The issue arises from a permissive regular expression, enabling an attacker who can access the affected product to log in to the management console and perform operations available there. Connected advisories (NV...

CVE-2026-64940

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2026-64940

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2026-18470 Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

CVE-2026-18470

The Login & Register Forms WordPress plugin (versions before 4.0.2 ) is vulnerable to unauthenticated email address disclosure . The root cause is a failure to verify that password reset requests originate from the actual account owner, combined with inadequate redaction of the response address. ...

CVE-2026-18468

The Login & Register Forms WordPress plugin, in versions prior to 4.0.2 , is vulnerable to an unauthenticated account takeover . The root cause is that the plugin fails to bind the password reset verification state to the specific account being reset or the party completing the verification; inst...