Password component compromise Data Compromise

The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

Password component DoS

The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-84645

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...

PT-2026-84715

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

PT-2026-84617

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

PT-2026-84674

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

CVE-2026-77782: Exposure of Sensitive Information to an Unauthorized Actor

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

CVE-2026-84801: Missing Authorization

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

CVE-2026-84480

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84483 WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hashhmac with the site's...

CVE-2026-84483

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php . An unauthenticated attacker can forge valid HMAC tokens by computing hash_hmac with the site's public base URL as the key and the current time as the message. With forged tokens, an attacker...

CVE-2026-84483 WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hashhmac with the site's...

CVE-2026-84483 WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hashhmac with the site's...

CVE-2026-84480 WWBN AVideo Password Recovery Token Expiration Bypass

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84480 WWBN AVideo Password Recovery Token Expiration Bypass

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84480

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php , allowing an attacker who obtains a recovery token to use it indefinitely to reset a target account's password and gain full account access . The vulnerability is network-exploitable with low complex...

CVE-2026-84480 WWBN AVideo Password Recovery Token Expiration Bypass

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84208 AVideo User_Location Plugin Unauthenticated SQL Injection

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the UserLocation plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing...

Filament: Password validity disclosure for accounts denied panel access on login page

When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating canAccessPanel. For an account that canAccessPanel denies, submitting the correct password renders the challenge while an incorrect password returns the generic failure message,...

GHSA-XWPV-PQXP-5V36 Filament: Password validity disclosure for accounts denied panel access on login page

When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating canAccessPanel. For an account that canAccessPanel denies, submitting the correct password renders the challenge while an incorrect password returns the generic failure message,...