CVE-2026-89022

BookStack before 26.05.5 is affected by an authentication bypass in its social login implementation. The root cause lies in SocialAuthService::handleLoginCallback , whose database query ignores the driver column when retrieving linked account records, allowing an unauthenticated attacker to authe...

EUVD-2026-78821

BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driverid namespace. Attackers can authenticate at...

CVE-2026-92082

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

CVE-2026-92082

Payara Server is vulnerable to brute-force login attacks because, by default, it does not limit the number of failed login attempts. The attack vector is adjacent network (AV:A) with low complexity and no privileges required, rated CVSS 4.0 6.3 (MEDIUM) with low confidential impact on the vulnera...

CVE-2026-92082 Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

CVE-2026-92082 Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

CVE-2026-90844

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-90844 PHPGurukul Daily Expense Tracker System Login index.php sql injection

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-90844

PHPGurukul Daily Expense Tracker System 1.1 is affected by a SQL injection vulnerability in the Login component, specifically in the file /dets/index.php. The flaw is triggered by manipulating the email argument, allowing remote unauthenticated exploitation over the network. The CVSS v3.1 base sc...

CVE-2026-90844 PHPGurukul Daily Expense Tracker System Login index.php sql injection

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...

EUVD-2026-78230

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-92082: Improper Restriction of Excessive Authentication Attempts

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

PT-2026-91769

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...

PT-2026-92025

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

PT-2026-92117

BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driver id namespace. Attackers can authenticate at...

CVE-2026-90844: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-89022: Authentication Bypass by Spoofing

BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driverid namespace. Attackers can authenticate at...

CVE-2026-78318

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 contain a heap-based buffer overflow vulnerability in its login process. In environments where domainuserseparator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain name,...