CVE-2025-9878: Improper Neutralization of Input During Web Page Generation

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-77127: Authorization Bypass Through User-Controlled Key

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

PT-2026-81228

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

JetBrains TeamCity < 2019.2.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2019.2.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs. CVE-2020-15829 - JetBrains TeamCity before 2019.2.3 is...

JetBrains TeamCity < 2022.04.4 (CVE-2022-40979)

The version of JetBrains TeamCity installed on the remote host is prior to 2022.04.4. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2022.04.4 environmental variables of password type could be logged when using custom Perforce executable CVE-2022-40979 Note that...

ALSA-2026:59379 Moderate: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...

PT-2026-81166

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajax iwar preview email function, which uses is admin as its only authorization check and allows...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account T...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to credential exposure in PostgreSQL [CVE-2026-6478]

Summary IBM Watson Speech Services Cartridge is vulnerable to credential exposure in PostgreSQL, due to covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication which allows an attacker to recover user credentials sufficient to authenticate CVE-2026-6478. PostgreSQL...

CVE-2026-59647

A flaw was found in Bouncy Castle for Java. The Certificate Request Message Format CRMF and Certificate Management Protocol CMP password-based Message Authentication Code MAC implementation allows for an unbounded iteration count. A remote attacker can exploit this by sending a specially crafted...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-78551

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

CVE-2026-71504

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply...

CVE-2026-71505

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in its Members REST API . Authenticated users with member-read privileges can query individual member or member list endpoints and retrieve bcrypt password verifiers that are not filtered by the base API serializer or the Mem...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

EUVD-2026-65084

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...