36878 matches found
CVE-2026-72693
openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...
EUVD-2026-55978
openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...
CVE-2026-72693
CVE-2026-72693 describes a privilege-escalation path in deployments using openvt -u with kbrequest/init. The root cause is an ownership check in authenticate_user() that uses stat("/proc//fd/0"), which follows the fd to the TTY node and reports the TTY owner instead of the process owner. If the T...
CVE-2026-72693
openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...
CVE-2026-72693 Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...
CVE-2026-72693
openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...
WordPress UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin UsersWP versions = 1.2.69...
PT-2026-70926
The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...
PT-2026-70198
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...
PT-2026-70084
Name of the Vulnerable Software and Affected Versions openvt affected versions not specified Description The openvt -u functionality is designed to identify the owner of the current Virtual Terminal VT and execute login as that user from a privileged context. A flaw exists in the authenticate use...
Linux Distros Unpatched Vulnerability : CVE-2026-72693
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init...
WordPress XSS2Shell 4.7.0 < 4.7.34 / 4.8.0 < 4.8.29 / 4.9.0 < 4.9.30 / 5.0.0 < 5.0.26 / 5.1.0 < 5.1.23 / 5.2.0 < 5.2.25 / 5.3.0 < 5.3.22 / 5.4.0 < 5.4.20 / 5.5.0 < 5.5.19 / 5.6.0 < 5.6.18 / 5.7.0 < 5.7.16 / 5.8.0 < 5.8.14 / 5.9.0 < 5.9.14 / 6.0.0 < 6.0.13 / 6.1.0 < 6.1.11 / 6.2.0 < 6.2.10 / 6.3.0 < 6.3.9 / 6.4.0 < 6.4.9 / 6.5.0 < 6.5.9 / 6.6.0 < 6.6.6 / 6.7.0 < 6.7.6 / 6.8.0 < 6.8.7 / 6.9.0 < 6.9.6 / 7.0.0 < 7.0.3 Login Screen XSS
The version of WordPress installed on the remote host is 4.7.x prior to 4.7.34, or 4.8.x prior to 4.8.29, or 4.9.x prior to 4.9.30, or 5.0.x prior to 5.0.26, or 5.1.x prior to 5.1.23, or 5.2.x prior to 5.2.25, or 5.3.x prior to 5.3.22, or 5.4.x prior to 5.4.20, or 5.5.x prior to 5.5.19, or 5.6.x...
PT-2026-70174
n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...
PT-2026-70100
Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch misp event and /misp search events endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domai...
CVE-2026-72902
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...
CVE-2026-72902
Dokploy (PaaS) vulnerability CVE-2026-72902 affects version prior to 0.29.13. An authenticated user can run arbitrary commands on a local/SSH target because registry.ts interpolates the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This is fixed in ...
Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core
TL;DR: CVE-2026-64638, dubbed XSS2Shell, is a high-severity WordPress Core vulnerability that begins as a pre-authentication reflected XSS on the login screen and can be chained to PHP code execution when a logged-in administrator is successfully targeted. WordPress fixed the issue in 7.0.3 and...
CVE-2026-66405
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products...
CVE-2026-64940
Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...