119091 matches found
CVE-2026-15212
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...
CVE-2026-65760
The CVE-2026-65760 entry concerns the Joomla Easy Store extension by joomshaper.com (versions 1.0.0–2.0.1). The vulnerability is described as improper access checks that allow logged-in users to retrieve order and customer information for any order, indicating a cross-customer confidentiality lea...
CVE-2026-15616
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...
CVE-2026-15617
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
EUVD-2026-48307
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
CVE-2026-65917 CyberPanel IncBackups IDOR via Sequential Backup ID
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
CVE-2026-65917 CyberPanel IncBackups IDOR via Sequential Backup ID
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
EUVD-2026-48305
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account...
CVE-2026-15611 Unverified email-based SSO account linking
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account...
EUVD-2026-48301
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...
CVE-2026-15616 Local MFA not enforced during SSO sign-in
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...
CVE-2026-15616
Logto has a CVE-2026-15616 issue where the authentication flow does not enforce locally configured MFA during SSO. The root cause is that MFA can be bypassed when hasVerifiedSsoIdentity is true, enabling an attacker with a federated identity from a permissive upstream IdP to sign in via SSO and b...
EUVD-2026-48300
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
CVE-2026-15617
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
CVE-2026-15617
CVE-2026-15617 affects Logto Identity Platform: during SSO, the system performs strict, unnormalized comparisons of identity attributes (email, issuer, identity IDs), allowing sessions to bind to unintended local accounts due to case/whitespace/Unicode differences. This can enable unauthorized ac...
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
Azure Portal Information Disclosure Vulnerability
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...
Azure Key Vault Elevation of Privilege Vulnerability
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network...