CVE-2026-71205 changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt...

CVE-2026-71205 changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt...

CVE-2026-71205 changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt...

CVE-2026-71205

The CVE-2026-71205 issue affects changedetection.io: the /login endpoint authenticates against a single shared password using PBKDF2-HMAC-SHA256 with no per-IP or per-session rate limiting, no failed-attempt counter, and no lockout. This effectively provides unlimited brute-force opportunities, a...

Multiple vulnerabilities in NetKids iMark

Overview NetKids iMark provided by Integrated Systems Technologies, Inc. contains multiple vulnerabilities listed below: Uncontrolled search path element CWE-427 - CVE-2026-66344 Unquoted search path or element CWE-428 - CVE-2026-66839 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported...

CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

CVE-2026-15372

The CVE describes a vulnerability in the WP 2FA WordPress plugin (pre-4.1.0) where the second authentication factor is not validated when a supported method is chosen at login. This allows an attacker who already has the user’s password to bypass 2FA and fully access the account, including admini...

CVE-2026-16036

CVE-2026-16036 affects the miniOrange 2FA WordPress plugin prior to version 6.2.7. The issue is that during the pre-login two-factor challenge, the second factor being configured is not bound to the target account’s existing factor. This enables an attacker who knows a user’s password to rebind t...

CVE-2026-16055

The CVE concerns the Contest Gallery WordPress plugin prior to 30.0.7. The root cause is that the front-end login bypasses the standard WordPress authentication flow, issuing an authentication cookie immediately after the password check. This bypasses brute-force protection and two-factor authent...

CVE-2026-15210

The CVE-2026-15210 entry concerns the WordPress plugin “OTP Login With Phone Number, OTP Verification” (before version 1.8.71). The vulnerability is that the plugin does not limit OTP verification attempts or invalidate a one-time code after a wrong guess, allowing an unauthenticated user to requ...

EUVD-2026-53117

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

EUVD-2026-53120

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled...

EUVD-2026-53121

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Galle...

EUVD-2026-53042

The Membership Plugin – Kadence Memberships plugin for WordPress formerly Restrict Content is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rcprocesslostpasswordform consuming th...

CVE-2026-70594

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...

Ghost: Session Fixation in Ghost Admin

Impact Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. Vulnerable versions This vulnerability is present in Ghost fro...

CVE-2026-70594

Ghost Admin did not invalidate existing sessions on login from version 2.2.0 through 6.54.1, enabling potential session fixation if another vulnerability on the same Ghost Admin domain was present. The issue could allow an attacker to hijack an authenticated session; exploitation would require an...

CVE-2026-70594 Ghost: Session Fixation in Ghost Admin

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...

CVE-2026-58071

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

CVE-2026-63248

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security...