CVE-2026-60206

🚨 CVE-2026-60206 — WebLogic SAML Takeover Oracle WebLogic Server SAML Authentication Vulnerability A technical analysis of CVE-2026-60206 affecting Oracle WebLogic Server. 📖 Overview CVE-2026-60206 is a Critical CVSS 9.9 vulnerability affecting Oracle WebLogic Server. According to Oracle, a...

CVE-2026-54036 LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authenticated user or attacker with a stolen session even when 2FA is already fully enabled on the account. This endpoint overwrites the existi...

Improper Authentication

calibreweb is vulnerable to Improper Authentication. The vulnerability exists in the login function of web.py file, which allows a remote attacker to takeover the account by bruteforcing due to improper restriction of excessive authentication attempts...

CVE-2018-8925

Cross-site request forgery CSRF vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the 1 username, 2 password, 3 admin, 4 action, 5 uid, or 6 modifyadmin parameter...

Redaxo CMS Cross-Site Scripting Vulnerability

Redaxo CMS is an open source Web portal content management system CMS. The system supports custom modules , plug-in extensions , project backup and so on. A cross-site scripting vulnerability exists in Redaxo CMS. The vulnerability allows attackers to steal cookie-based authentication, take contr...