50826 matches found
CVE-2026-45413 MaxKB: Unsalted MD5 Password Hashing
MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, user passwords are stored using unsalted MD5 hashes, making them trivially crackable via rainbow tables or GPU-accelerated brute force hashcat. This vulnerability is fixed in 2.9.1...
CVE-2026-45413 MaxKB: Unsalted MD5 Password Hashing
MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, user passwords are stored using unsalted MD5 hashes, making them trivially crackable via rainbow tables or GPU-accelerated brute force hashcat. This vulnerability is fixed in 2.9.1...
CVE-2026-27331 WordPress WpTravelly plugin <= 2.1.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpTravelly: from n/a through 2.1.5...
CVE-2026-27331
Summary: CVE-2026-27331 affects the WordPress plugin WpTravelly (
CVE-2026-8856
creationtimestamp| type| source ---|---|--- 2026-05-26 19:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmroikayjn2t...
CVE-2026-4051
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an attacker with administrative privileges to execute remote code due to exposed method that is not properly restricted...
CVE-2026-4051
CVE-2026-4051 concerns IBM Engineering Lifecycle Management - Jazz Foundation. Affected products/versions: 7.0.3 (through iFix021), 7.1.0 (through iFix009), 7.2.0 (through iFix001). Root cause: an exposed method that is not properly restricted, enabling a user with administrative privileges to pe...
CVE-2026-44668 Faction: Unauthenticated Read, Modify, and Delete of Boilerplate Templates
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke without checking for a valid session. Four action methods in BoilerPlateConfig perform no local...
EUVD-2026-31940
nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint /auth/v1/introspectaccesstoken accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims...
WordPress Two-factor authentication (formerly IP Vault) plugin <= 2.1 - Cross-Site Request Forgery to Settings Update vulnerability
Cross-Site Request Forgery to Settings Update vulnerability discovered by afnaan - SMKN 1 Bantul in WordPress Plugin IP Vault – WP Firewall versions = 2.1...
CVE-2026-48896
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48897
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48896
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48897
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-44502
Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be partially bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For...
EUVD-2026-31913
Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When filtering by a custom attribute of type date or number using the isgreaterthan or islessthan operators, user-supplied values in the values...
CVE-2026-48896
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
EUVD-2026-31890
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48896
CVE-2026-48896 affects Joomla! Core MFA authentication, caused by insufficient state checks that allow bypassing 2FA. The CVE entry cites a 2FA bypass vector with high impact ( Confidentiality/Integrity/Availability as noted in the CVSS data: integrity impact HIGH, others NONE/NEGLIGIBLE). Connec...