87460 matches found
CVE-2026-14563 Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...
EUVD-2026-75961
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...
CVE-2026-14559 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...
CVE-2026-14559
The teddy-bear-customize-addon WordPress plugin (versions ≤ 1.0.5 ) contains an unauthenticated account takeover vulnerability. The root cause is a failure to verify a user's password during the authentication process. This allows unauthenticated attackers to log in as any registered user, includ...
EUVD-2026-75887
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...
CVE-2026-81905
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...
CVE-2026-38058: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...
PT-2026-89772
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...
PT-2026-89775
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...
CVE-2025-15679: Empty Password in Configuration File
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...
PT-2026-96463
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer set attribute populates the security area of the BIOS attribute request buffer with the current admin password via populate security buffer, then dumps the...
Fedora 44 : curl (2026-f26b509a1a)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f26b509a1a advisory. - Fix HTTP/2 stream-dependency tree UAF CVE-2026-10536 - Fix Native CA trust persist CVE-2026-11564 - Fix stale proxy password leak CVE-2026-9079 -...
PT-2026-90525
Name of the Vulnerable Software and Affected Versions Inventory Management Component affected versions not specified Description An example environment-configuration file for a bundled inventory-management component contains a fixed, publicly-known administrative password. If this example file is...
PT-2026-89880
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...
PT-2026-90046
Name of the Vulnerable Software and Affected Versions Xiongmai IP Camera XM530 versions prior to HMT.CM2005-v220608.1837 Description An improper authentication issue exists in the WS-Security wsse:UsernameToken verification routine of the Sofia IPC daemon. This occurs when an account's stored...
ROS-20260911-73-0068
The vulnerability of the Password component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...
ROS-20260911-73-0158
The vulnerability of the Password component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
ROS-20260911-73-0040
The vulnerability of the Password component in Microsoft Edge and Google Chrome relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...
ROS-20260911-73-0087
The vulnerability of the Password component in browsers Google Chrome and Microsoft Edge is related to deficiencies in the data source verification mechanism. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...