87466 matches found
CVE-2026-88895: Improper Authentication
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...
PT-2026-89383
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage tha...
ROS-20260910-73-0135
The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...
ROS-20260910-73-0123
The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...
PT-2026-89655
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...
CVE-2026-81796: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3...
PT-2026-89412
Name of the Vulnerable Software and Affected Versions LIBRID/LIBREF versions 2.01.0.2183 through 18.9.26.2319 Description A weak password recovery mechanism for forgotten passwords allows for password recovery exploitation. Recommendations At the moment, there is no information about a newer...
PT-2026-89385
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live:: getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...
CVE-2026-88872: Cross-Site Request Forgery (CSRF)
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage tha...
CVE-2026-88271: Missing Authorization
GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR...
ROS-20260910-73-0116
The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
ROS-20260910-73-0078
The vulnerability of the Password component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential data through a specially created HTML page...
ROS-20260910-73-0063
The vulnerability of the Password component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
MiracleLinux 9 : pam-1.5.1-28.el9_8.1 (AXSA:2026-1797:03)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1797:03 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block direct...
JetBrains TeamCity 2023.11 - 2023.11.4 Information Disclosure (CVE-2024-28173)
The version of JetBrains TeamCity installed on the remote host is version 2023.11 up to but not including 2023.11.4. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the password type could be disclosed CVE-2024-28173...
JetBrains TeamCity 2018.2 - 2019.2.1 Information Disclosure (CVE-2020-11938)
The version of JetBrains TeamCity installed on the remote host is version 2018.2 up to and including 2019.2.1. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. T...
ROS-20260910-73-0154
The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...
Oracle Linux 10 : ELSA-2026-66392-0: / apr-util (ELSA-2026-663920)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-663920 advisory. - Resolves: RHEL-236629 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 ...
CVE-2026-14873: Missing Authorization
The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...
