CVE-2026-18165

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

EUVD-2026-59760

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

CVE-2026-19895

CVE-2026-19895 affects open source POS Open Source Point of Sale, version up to 3.4.2. The vulnerability lies in Login::index (file app/Config/Filters.php, Login Endpoint), where excessive authentication attempts are improperly restricted. This allows a remote attack with high complexity; exploit...

CVE-2026-19895 opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

CVE-2026-15303

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

EUVD-2026-58840

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

CVE-2026-15001 bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

CVE-2026-15001

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

PT-2026-72144

Name of the Vulnerable Software and Affected Versions 6Storage Rentals versions prior to 2.27.1 Description An authentication bypass exists that allows unauthenticated attackers to log in as any existing WordPress user, including administrators. The issue occurs because the six storage create wp...

PT-2026-73032

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin

On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder, a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically th...

CVE-2026-49826 Concourse login flow has an open redirect issue

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

CVE-2026-19834 Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...

GO-2024-2598 vulnerabilities

Vulnerabilities for packages: nats-server, nri-memcached, aws-flb-kinesis, cass-operator, flux-helm-controller, secrets-store-csi-driver-provider-aws, cri-tools, nri-cassandra, nri-mongodb, aws-load-balancer-controller, kubebuilder, aws-flb-firehose, k8sgpt, dagger, task, newrelic-infra-operator,...

CVE-2026-19297

IBM Langflow OSS 1.0.0–1.9.6 is affected by CVE-2026-19297 due to CWE-307: insufficient restriction of excessive authentication attempts, enabling a remote attacker to obtain unauthorized access to user accounts. The IBM Security Bulletin notes a rate-limiting mechanism for POST /api/v1/login, co...

CVE-2026-19297 Insufficient Authentication Brute Force Protection on Login Endpoint

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts...

CVE-2026-73655

Trigger.dev prior to 4.5.2: addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring email_verified. When existingEmailUser && !existingUser is true, the flow writes th...

CVE-2026-28185

Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...

PrestaShop - Information Disclosure

User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the idemployee and resettoken parameters. An attacker who has access to the Back Office login URL can trigger the...

CVE-2026-46688 Meeting Room Booking System has an unauthenticated open redirect

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...