87875 matches found
PT-2026-77230
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...
PT-2026-78250
Name of the Vulnerable Software and Affected Versions PPWP: Password Protect Pages, Posts & Full or Partial Content versions prior to 1.9.16 Description An improper capability check in the can access function allows authenticated attackers with Contributor-level access or higher to retrieve a...
PT-2026-80243
Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affected endpoints retrieve full database rows using SELECT , SELECT alias., or equivalent full-row queries, then return the results directly through $this-response... without removing...
Moderate: pam security update
Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...
CVE-2026-1199: Concurrent Execution using Shared Resource with Improper Synchronization
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...
PT-2026-78571
Name of the Vulnerable Software and Affected Versions TrueBooker – Appointment Booking and Scheduler System versions prior to 1.2.7 Description An authorization bypass exists due to the admin user create cus AJAX handler lacking authentication or capability checks. This allows unauthenticated...
CVE-2026-45791
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...
package pkcs12: Authentication bypass in Decode functions
Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS12 files from untrusted sources and rely on the password for authentication can be tricke...
EUVD-2026-60477
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...
CVE-2026-45791 Dokploy: Password Change Does Not Revoke Active Sessions
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...
CVE-2026-45791 Dokploy: Password Change Does Not Revoke Active Sessions
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...
CVE-2026-45791
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...
CVE-2026-75103
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...
CVE-2026-75103
Crawlab 's password-change endpoint (core/controllers/user_v2.go) lacks authorization checks, so any authenticated user can reset any account's password. Combined with account enumeration via the user listing endpoint, attackers can compromise admin credentials to achieve full account takeover an...
CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...
CVE-2026-75012
A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be...
CVE-2026-75012 TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference
A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be...
EUVD-2026-60360
A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be...
CVE-2026-75012
A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be...