CVE-2026-119096

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...

CVE-2026-119096

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to an Authentication Bypass in versions up to and including 3.8.2 . The vulnerability exists in the uo_login_action() function due to a parser-differential flaw involving the email parameter. While the plugin's account-verificat...

EUVD-2026-114649

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...

CVE-2026-119096: uncannyowl Uncanny Toolkit for LearnDash: The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and…

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...

PT-2026-81234

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval...

CVE-2026-70490

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...

CVE-2026-70490: Incorrect Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...

WordPress WP Frontend Profile plugin <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection vulnerability

Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection vulnerability discovered by johska in WordPress Plugin WP Frontend Profile versions = 1.3.8...

CVE-2026-1644 WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection

The WP Frontend Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This is due to missing nonce validation on the 'updateaction' function. This makes it possible for unauthenticated attackers to approve or reject user account...

PT-2026-5067

Name of the Vulnerable Software and Affected Versions New User Approve plugin for WordPress versions up to and including 3.2.2 Description The New User Approve plugin for WordPress is susceptible to unauthorized data access and modification. This is due to a missing capability check on multiple...

DRUPAL-CONTRIB-2019-048

This module enables you to use special routes for user registration with special roles and custom field sets defined for the role. The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role. This...