87671 matches found
UBUNTU-CVE-2026-82470
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...
CVE-2026-82470
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...
CVE-2026-82467 Rodauth before 2.47.0 Open Redirect via Return-to Path
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and twofactorauthreturntorequestedlocation features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting...
CVE-2026-82453
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...
CVE-2026-82453 rust-iot-platform Cleartext Password Storage via User Model
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...
CVE-2026-82453 rust-iot-platform Cleartext Password Storage via User Model
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...
CVE-2026-82453
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts. The vulnerability is scored CVSS 3.1: 7.5 (HIGH) and CVSS 4.0: ...
CVE-2026-82453 rust-iot-platform Cleartext Password Storage via User Model
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...
EUVD-2026-68108
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...
CVE-2026-82449
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...
Improper Certificate Validation
org.mariadb.jdbc:mariadb-java-client is vulnerable to Improper Certificate Validation. The vulnerability is due to improper certificate fingerprint validation during the initial TLS handshake, which allows an active man-in-the-middle attacker or malicious server to present a self-signed certifica...
EUVD-2026-68098
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...
CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...
CVE-2026-77012 Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...
CVE-2026-77012
The 爱采集数据采集和发布插件 WordPress plugin (versions
SUSE CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
Malicious Package
Overview paper-password-input is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PT-2026-83432
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...
FreeBSD : phpBB -- multiple vulnerabilities (4d06b948-a323-11f1-a655-3497f65b111b)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4d06b948-a323-11f1-a655-3497f65b111b advisory. The phpBB Team reports: Changes since 3.3.16: Improper state verification in OAuth implementation...
CVE-2026-55860
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a...