CVE-2026-16642

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions:...

CVE-2026-16642

Drupal Email Login OTP (a Drupal contrib module) has a critical-severity security issue affecting all versions (. ). The Drupal security team has marked the project unsupported , meaning the maintainer has not provided a fix. The CNA-assigned CVSS 3.1 score is 5.7 (MEDIUM) with a vector requiring...

CVE-2026-16642 Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions:...

CVE-2026-18260 Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091

Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions:...

CVE-2026-18260

CVE-2026-18260 affects the Drupal Disable Login Page contrib module, with all versions impacted. The project has been marked as unsupported by the Drupal security team, and the maintainer has not provided a fix, meaning no patched release is currently available. The CVSS 3.1 score is 5.7 (Medium)...

Reflected-XSS-in-Vvveb-CMS-v1.0.7.2

लॉगिन फॉर्म ईमेल और पासवर्ड फ़ील्ड में रिफ्लेक्टेड XSS - Vvveb CMS v1.0.7.2 लेखक: Andrew Paul खोज की तिथि: August 12th, 2025 विक्रेता: Vvveb विक्रेता URL: http://vvveb.com विक्रेता GitHub: https://github.com/givanz/Vvveb प्रभावित संस्करण: 1.0.7.2 और संभवतः पिछले संस्करण CVE ID: CVE-2025-9728 सारा...

CVE-2024-54820

Vulnerabilità: SQL Injection non autenticata - Dump di credenziali in chiaro Autore : Javier Carabantes Software interessato : XOne Web Monitor Software : https://xone.es/ Versione interessata : 02.10.2024.530 framework 1.0.4.9 Descrizione È stata scoperta una vulnerabilità di SQL injection non...

CVE-2025-13390

WP Directory Kit = 1.4.4 - Bypass de Autenticação para Escalação de Privilégios via Account Takeover Resumo O plugin WP Directory Kit para Wordpress versão 1.4.4 e anteriores contém um bypass de autenticação na sua funcionalidade de auto-login. A vulnerabilidade permite que atacantes não...

CVE-2024-7591-PoC

CVE-2024-7591-PoC Estes scripts Python PoC testam o Kemp LoadMaster para execução remota de código. ESTA FERRAMENTA DESTINA-SE APENAS A FINS DE TESTE Estes scripts foram baseados no artigo de Marius Walter sobre os detalhes desta exploração. Pode ler o seu post em:...

CVE-2020-15367

CVE-2020-15367 Brute Force su Supravizio BPM 10.1.2 Descrizione Venki Supravizio BPM 10.1.2 non limita il numero di tentativi di autenticazione. Un utente non autenticato può sfruttare questa vulnerabilità per lanciare un attacco di forza bruta contro la pagina di login. Sfruttamento Per sfruttar...

EUVD-2026-54678

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login...

tofu

tofu A modular tool for hacking offline Windows filesystems and bypassing login screens. Can do hashdumps, OSK-Backdoors, user enumeration and more. How it works : When a Windows machine is shut down, unless it has Bitlocker or another encryption service enabled, it's storage device contains...

EUVD-2026-65620

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the pa...

CVE-2026-26211

Ekushey Project Manager CRM 5.0 is affected by a stored XSS vulnerability in the administrator-configured system name field. The value is written to the login page without output encoding, and its occurrence in an h4 element is parsed as markup, causing any injected HTML event handlers to execute...

CVE-2026-79992

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...

CVE-2026-64638

CVE-2026-64638 // XSS2Shell Analisi tecnica e matrice di mitigazione difensiva per il vettore CVE-2026-64638 XSS2Shell, un'inconsistenza critica nel parsing della schermata di autenticazione di WordPress Core che consente di concatenare un Cross-Site Scripting XSS riflesso pre-autenticazione con...

BIT-KEYCLOAK-2024-4629 Keycloak: potential bypass of brute force protection

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

BIT-KEYCLOAK-2026-7507 Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which...

BIT-KEYCLOAK-2026-3047 Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language SAML client is configured as an Identity Provider IdP-initiated broker landing target, it can still complete the login process and establish a Single Sign-On SSO session. This allows a remote attacker...

BIT-KEYCLOAK-2026-2603 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...