40999 matches found
CVE-2026-69657
XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...
CVE-2026-69657
XING CPTrans-ME-X contains a Use of Default Password vulnerability (CWE-1393), meaning anyone who knows the default credential can log in to the affected device. The vulnerability is rated CRITICAL with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 base score...
kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
A flaw was found in the Linux kernel's iSCSI Internet Small Computer System Interface target functionality. This vulnerability, a heap overrun, occurs because the iscsiencodetextoutput function does not properly check buffer capacity when processing login requests. A remote attacker could exploit...
CVE-2026-55512: Uncontrolled Resource Consumption
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC...
CVE-2026-75170
The HubCore platform (version 14.1.1) is vulnerable to a Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint. A remote unauthenticated attacker can inject arbitrary JavaScript into the application's response by exploiting the language POST parameter . Practical conse...
CVE-2026-70403: Use of Hard-coded Password
XING CPTrans-ME-X contains a Use of Hard-coded Password CWE-259. Anyone with the knowledge of the credential may log in to the affected device...
CVE-2026-85636: Missing Authentication for Critical Function
A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and...
PT-2026-85411
🚨 CRITICAL: CVE-2026-69657 CVSS 9.8 XING CPTrans-ME-X uses default passwords allowing unauthorized remote access. Attackers can gain full control with no authentication required. Action: Change default credentials immediately. CVE Vulnerability PatchNow https://t.co/1Y4Tw4gKye...
PT-2026-86221
A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and...
CVE-2026-75170
Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...
CVE-2026-69657: Use of Default Password
XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...
EUVD-2026-70698
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...
SUSE CVE-2026-12704
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and ga...
grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route
A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...
grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route
A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...
WordPress theme My Login plugin 7.0-7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability
Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Theme My Login versions 7.0-7.1.15...
pac4j-check v0.2.0
pac4j-check 离线排查 CVE-2026-29000CVSS 10.0—— 包括官方 advisory 没有列出的那些包。 English | 中文 单个 jar,约 24KB,零运行时依赖,Java 8 起可用,完全离线,不外传任何数据。 这个漏洞是什么 org.pac4j:pac4j-jwt 的 JwtAuthenticator 在处理加密 JWTJWE 时未强制校验签名。 攻击者只要拿到服务器的 RSA 公钥公钥本来就是公开的, 就能构造一个 JWE 包裹的 PlainJWT,把 subject 和 role 写成任意值, 以任意用户身份登录,包括管理员 。无需任何凭据。...
EUVD-2026-62540
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge...
GHSA-7MGC-C7PQ-3RR3 Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the login.regenerate2FASecret task which requires only $user-exists, not $user-authorized can be called...
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the login.regenerate2FASecret task which requires only $user-exists, not $user-authorized can be called...