87774 matches found
CVE-2026-19851: Use of Default Password
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import...
CVE-2026-79673: Incorrect Authorization
Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...
PT-2026-81497
Name of the Vulnerable Software and Affected Versions TranslatePress versions prior to 3.3.2 Description An unauthenticated attacker can retrieve a plaintext password-reset URL via the trp get translations regular AJAX endpoint, enabling the takeover of any administrator account. This issue affec...
EulerOS Virtualization 2.13.0 : samba (EulerOS-SA-2026-3237)
According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...
JetBrains TeamCity < 2019.2.2 (CVE-2020-11687)
The version of JetBrains TeamCity installed on the remote host is prior to 2019.2.2. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages. CVE-2020-11687 Note that Nessus has not tested for this...
JetBrains TeamCity < 2021.1 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2021.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used. CVE-2021-37546 - In JetBrains TeamCity before...
PT-2026-81909
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...
PT-2026-81292
Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...
PT-2026-81387
NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi...
"Am I Just That Dumb?": Applicability, Action and Verification in Consumer IoT Security Advice
Public campaigns urge people to change default passwords on Internet of Things IoT devices and keep them updated, assuming users can independently determine whether the advice applies. We gave 28 participants in the Netherlands two pieces of government-issued advice reflecting guidance in several...
pam security update
1.6.1-9.1 - pamuserdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704...
CVE-2025-9878: Improper Neutralization of Input During Web Page Generation
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied...
CVE-2026-77127: Authorization Bypass Through User-Controlled Key
The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...
PT-2026-81228
The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...
JetBrains TeamCity < 2019.2.3 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2019.2.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs. CVE-2020-15829 - JetBrains TeamCity before 2019.2.3 is...
JetBrains TeamCity < 2022.04.4 (CVE-2022-40979)
The version of JetBrains TeamCity installed on the remote host is prior to 2022.04.4. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2022.04.4 environmental variables of password type could be logged when using custom Perforce executable CVE-2022-40979 Note that...
ALSA-2026:59379 Moderate: pam security update
Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...
PT-2026-81166
The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajax iwar preview email function, which uses is admin as its only authorization check and allows...
VulnCheck KEV: CVE-2026-18963
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
