signal-without-smartphone

Setup Signal without smartphone A Desktop application to register an account with Signal and link it with Signal Desktop, all without requiring a smartphone. This utility avoids the need of a smart phone, but still requires a way to receive SMS messages during the setup phase. Signal recently...

EUVD-2026-116586

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the...

CVE-2026-121728

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the...

CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the...

CVE-2026-121728

SourceHut meta.sr.ht versions 0.56.11 through 0.89.0 are vulnerable to an authorization bypass that allows unauthenticated attackers to register accounts even when public registration is disabled. The root cause is an unchecked GraphQL RegisterAccount mutation triggered by POSTing credentials to ...

CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the...

PT-2026-136711

Name of the Vulnerable Software and Affected Versions SourceHut meta.sr.ht versions 0.56.11 through 0.88.9 Description An authorization bypass allows unauthenticated attackers to register accounts even when public registration is disabled. The issue occurs because the registration path incorrectl...

CVE-2022-23361

Mobile Verification Bypass While Registering a New Account ------ Affected Product JDOmni---- All the Websites Built With JDOmni are Vulnerable. This repository is a public reference for CVE-2022-23361. This vulnerability is now fixed by a vendor. Connect with me:- LinkedIn-...

CVE-2026-109145

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an...

CVE-2026-109145 User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an...

EUVD-2026-101852

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an...

CVE-2026-109145: Improper Privilege Management

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an...

PT-2026-114789

Name of the Vulnerable Software and Affected Versions User Rights Access Manager versions prior to 1.1.4 Description An issue exists where an AJAX account-registration handler does not restrict access, allowing unauthenticated attackers to register accounts. These newly created accounts are...

VulnCheck KEV: CVE-2026-18039

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...

PT-2026-109130

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

EUVD-2026-94811

A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an...

CVE-2026-4894

Multiple products from Frappe Technologies , specifically Frappe Cloud/ERPNext , are vulnerable to an authentication bypass due to insufficient validation in the authentication process. An unauthenticated remote attacker can manipulate the email field in the /api/method/press.api.account.signup e...

CVE-2026-104978

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...

CVE-2026-104978 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...

CVE-2026-104978

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...