175312 matches found
CVE-2026-19050
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...
CVE-2026-18046
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...
EUVD-2026-57084
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...
EUVD-2026-57077
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection...
CVE-2026-18961
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by...
bind: bind9: Incorrect acceptance of NSEC3 records
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...
CVE-2026-18961
The CVE describes a vulnerability in the VentraConnect Social Login WordPress plugin (up to version 1.4.3) where an unverified email field returned by Spotify’s /v1/me endpoint is trusted as mailbox ownership. The plugin copies this value into a user profile and logs in the user via get_user_by('...
CVE-2026-18961 Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by...
EUVD-2026-57065
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by...
EUVD-2026-57006
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...
EUVD-2026-56982
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and...
EUVD-2026-56981
The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...
PT-2026-71035
POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This...
Stack buffer overflow in WAD
...
PT-2026-76590
Name of the Vulnerable Software and Affected Versions Drupal External Authentication versions 0.0.0 through 2.0.13 Description Improper handling of case sensitivity allows privilege escalation. The module fails to ensure exact matching of externally supplied identity values when storing and looki...
PT-2026-71279
Name of the Vulnerable Software and Affected Versions Dell Display and Peripheral Manager DDPM Windows versions prior to 2.3.0.17 Description An authentication bypass by spoofing allows a low privileged attacker with local access to achieve elevation of privileges and execute arbitrary code...
PT-2026-71062
Name of the Vulnerable Software and Affected Versions FortiWeb versions 8.0.0 through 8.0.2 FortiWeb versions 7.6.0 through 7.6.5 FortiWeb versions 7.4.x FortiWeb versions 7.2.x FortiWeb versions 7.0.x Description An incomplete list of disallowed inputs may allow an attacker to achieve improper...
PT-2026-71350
Name of the Vulnerable Software and Affected Versions WolfStack versions prior to 25.9.2 Description A hard-coded cluster-authentication secret is compiled into every build and published as a constant in src/auth/mod.rs. This allows remote unauthenticated attackers to bypass authentication by...
