CVE-2025-14104: Out-of-bounds Read

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function, affecting SUID Set User ID login-utils utilities writing to the password database...

The vulnerability of the Mattermost instant messaging application, related to the improper implementation of authentication algorithms, allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the Mattermost instant messaging application is related to the improper implementation of the authentication algorithm when processing the /users/login/sso/code-exchange endpoint. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain...

WordPress Wp Social Login and Register Social Counter plugin <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering vulnerability

Missing Authorization in Cache REST Endpoints to Social Counter Tampering vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Wp Social versions = 3.1.3...

CVE-2025-66489

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in...

Central Dogma's Login Function Has an Open Redirect Vulnerability

Impact Successful exploitation of this vulnerability could allow an attacker to craft a malicious link that, when clicked by a victim, redirects them to a phishing website designed to mimic the legitimate Central Dogma login page. This could result in the compromise of user accounts and...

GHSA-4HR2-XF7W-JF76 Central Dogma's Login Function Has an Open Redirect Vulnerability

Impact Successful exploitation of this vulnerability could allow an attacker to craft a malicious link that, when clicked by a victim, redirects them to a phishing website designed to mimic the legitimate Central Dogma login page. This could result in the compromise of user accounts and...

CVE-2025-13390

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdkgenerateautologinlink" function. This is due to the feature using a cryptographically weak token...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect in the Shiro web login for logged-in users with incorrect permissions. An attacker can redirect users to malicious websites by crafting specially designed URLs. Remediation Upgrade...

Adobe Experience Manager (AEM) Sling Login Panel Detected

This plugin detects the presence of the Adobe Experience Manager AEM Sling Login panel on a web application. The Sling Login panel is part of the Apache Sling framework used by AEM for content delivery and management, providing authentication and access control features. No source data...

Adobe Experience Manager (AEM) Login Panel Detected

This plugin detects the presence of the Adobe Experience Manager AEM login panel on a web application. AEM is a comprehensive content management solution for building websites, mobile apps, and forms. No source data...

CVE-2025-66489 Cal.com Authentication Bypass via bad TOTP + password checks

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in...

EUVD-2025-201128

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in...

CVE-2025-66489

Cal.com (open-source scheduling software) versions prior to 5.9.8 are affected by an authentication bypass flaw in the login credentials provider. The issue arises when a non-empty totpCode is supplied, causing the password verification step to be bypassed during login through the /api/auth/callb...

DRUPAL-CONTRIB-2025-124

This module enables you to disable the standard Drupal login form /user/login so site owners can prevent interactive logins via the UI. The module does not sufficiently block authentication when the REST/HTTP login route is used. An attacker or legitimate user with valid credentials can...

DRUPAL-CONTRIB-2025-120

This module enables you to apply time-based login restrictions and display related warning or logout confirmation pages. The module doesn't sufficiently protect its confirmation routes from cross-site request forgery CSRF, allowing the logout confirmation route to be triggered without user...

BIT-ACTIVEMQ-2021-26117 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error...

CVE-2025-13390

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdkgenerateautologinlink" function. This is due to the feature using a cryptographically weak token...

CVE-2025-13390

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdkgenerateautologinlink" function. This is due to the feature using a cryptographically weak token...

EUVD-2025-200972

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdkgenerateautologinlink" function. This is due to the feature using a cryptographically weak token...

CVE-2025-13390

CVE-2025-13390 affects the WordPress plugin WP Directory Kit, versions up to 1.4.4. The flaw is an authentication bypass caused by a weak token generation in the wdk_generate_auto_login_link function, making tokens predictable and allowing unauthenticated attackers to gain administrative access a...