36861 matches found
PT-2026-79510
Name of the Vulnerable Software and Affected Versions ManageWP Worker versions prior to 4.9.37 Description An authentication bypass exists because the plugin fails to bind the account being logged in to the signature that authorizes the login. Additionally, the system does not prevent the replay ...
Linux Distros Unpatched Vulnerability : CVE-2026-55185
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go UR...
CVE-2026-55185 Miniflux 2: Open Redirect Bypass
Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker c...
CVE-2026-27463
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...
EUVD-2026-64124
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...
CVE-2026-27463
Combodo iTop , a web-based IT service management tool, prior to version 3.2.3 , exposes the full application version in the HTML title attribute of the logo on the login page. This allows unauthenticated remote attackers to fingerprint the exact version, facilitating targeted exploitation of know...
CVE-2026-27463 Combodo iTop: Version disclosure via login page logo
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...
CVE-2026-27463 Combodo iTop: Version disclosure via login page logo
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...
EUVD-2026-64008
A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...
CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface
A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...
CVE-2026-17252
A stack-based out-of-bounds write vulnerability exists in the login request handling of the administrative web interface on TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the flaw by sending a specially crafted malformed HTTP request, causing the web service proces...
CVE-2026-18356
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...
EUVD-2026-63912
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...
CVE-2026-18356 Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...
CVE-2026-18356
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 contains a bypass in its username denylist mechanism. The plugin fails to compare login attempts against the denylist case-insensitively and does not account for the account's email address , allowing an account that an administrator...
CVE-2026-77264
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...
EUVD-2026-63827
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...
Extracter
Extracter Extracter è uno strumento utile per trovare pannelli di login su un sito web; raccoglie informazioni da un file robots o da altre aree che il sito potrebbe avere. Questo strumento è stato creato solo per divertimento e non dovrebbe essere usato per abusare di altri siti senza alcun...
RLSA-2026:57610 Moderate: kbd security update
The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files. Security Fixes: kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-726...