CVE-2026-102894

GPUStack, an open-source GPU cluster manager, is vulnerable to an authentication bypass and account takeover in versions 0.7.1 through 2.2.2. The /auth/saml/callback endpoint fails to call OneLogin_Saml2_Auth.process_response, resulting in the processing of unverified SAML XML. Attackers can subm...

CVE-2025-71456

The vtenext software (versions before 25.02.2 ) is vulnerable to an SQL injection flaw located in the modules/Fax/EditView.php component. This vulnerability exists because the application fails to properly neutralize the fieldname parameter. Authenticated users with low privileges can exploit thi...

CVE-2026-121939

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as an...

CVE-2026-121939 Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as an...

CVE-2026-121939

The software Databasement versions prior to 1.10.9 is affected by an authentication bypass vulnerability in the OAuthService::findOrCreateLocalUser() function. The root cause is that the system links OIDC identities to local users based on email addresses without verifying the email_verified stat...

EUVD-2026-116896

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as an...

ghostbuster

Table of Contents Table of Contents Ghostbuster The problem Project Features Installing Ghostbuster Using Ghostbuster Example Output Setting up your AWS accounts Setting up Cloudflare Optional Authors License Ghostbuster Eliminate dangling elastic IPs by performing analysis on your resources with...

CVE-2026-114421

SEPPmail Secure Email Gateway versions before 15.1.1 is vulnerable to an account takeover due to a weak password recovery mechanism . The flaw allows a remote unauthenticated attacker who identifies a created but unregistered GINA account with an empty initial password to perform a password recov...

tirreno

tirreno tirreno is open security analytics. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your applications from cyber threats, account takeovers, bots, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised...

EUVD-2025-211250

The system fails to properly enforce scope authorization when the authorizeallscopes configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization,...

Apache StreamPipes <= 0.93.0 - Use of Cryptographically Weak PRNG in Recovery Token Generation

Apache StreamPipes from version 0.69.0 through 0.93.0 uses a cryptographically weak Pseudo-Random Number Generator PRNG in the recovery token generation mechanism. Given a valid token it's possible to predict all past and future generated tokens. id: CVE-2024-29868 info: name: Apache StreamPipes ...

Theme My Login <= 7.2.1 - Privilege Escalation

Theme My Login TML retrievepassword - wpupdateuser, this filter fires on the EXISTING target user, overwriting their password with an attacker-chosen value. An unauthenticated attacker can therefore take over any account, including a network administrator, by sending userpass1 in the lost-passwor...

OctoberCMS - Account Takeover

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. id:...

SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updati...

Branda WordPress plugin - Privilege Escalation

Branda WordPress plugin = 3.4.24 contains a privilege escalation caused by improper user identity validation in password update functionality, letting unauthenticated attackers change arbitrary user passwords, including administrators, exploit requires crafted request. id: CVE-2025-14998 info:...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2776 info: name: SysAid On-Prem = 23.3.40 - XML External Enti...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

ClinicCases 7.3.3 Cross-Site Scripting

ClinicCases 7.3.3 is susceptible to multiple reflected cross-site scripting vulnerabilities that could allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft. id: CVE-2021-38704 info: name:...

Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover

The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to chan...

WWBN AVideo 11.6 - Cross-Site Scripting

A reflected XSS vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff, allowing arbitrary Javascript execution. id: CVE-2023-48728 info: name: WWBN AVideo 11.6 - Cross-Site Scripting author: ritikchaddha severity: medium...