CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052

CVE-2026-18052 affects the ManageWP Worker WordPress plugin in versions prior to 4.9.37 . The plugin's auto-login mechanism fails to bind the target account to the cryptographic signature that authorises the login, and does not prevent replay of an already-used login link. An attacker who obtains...

CVE-2026-64961

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-64961

ATutor (a learning management system) is vulnerable to authentication bypass in its auto-login functionality. Although a token validation check exists, the values required for token validation remain uninitialized in certain code paths , allowing an unauthenticated attacker who knows a user's ide...

EUVD-2026-63361

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-47234

CVE-2026-47234 affects Admidio before 5.0.10. When debug logging is enabled, Admidio logs raw cookie values and the active session ID via Session::setCookie() and Session::start(), exposing live session tokens (including auto-login cookies) in application logs. This creates a local/credential-sto...

CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47363

The CVE-2026-47363 describes a vulnerability in the Datadog Android app where the launcher activity AppActivity is exported with no permission guard and launchMode=singleTask. On every onCreate/onNewIntent, an extension (Intent.getUserSession()) deserializes a full UserSession (including user ide...

CVE-2026-9130

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...

CVE-2026-9130

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...

CVE-2026-9130 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...

CVE-2026-9130

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...

CVE-2026-15368

The CVE describes a vulnerability in the WordPress plugin User Profile Builder, affecting versions prior to 3.16.4. The flaw permits an unauthenticated attacker to obtain an authenticated session on an existing user (including administrators) by abusing the automatic login after registration on s...

CVE-2026-15368 Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

Vulnerabilities handled in IBM Langflow OSS

IBM has addressed several vulnerabilities in the IBM Langflow OSS versions from 1.0.0 to 1.10.0. The vulnerabilities in IBM Langflow OSS include: - Execution of arbitrary file modifications by authorized users through specially crafted Content-Disposition headers. - Server-side request forgery SS...

CVE-2026-9103

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabl...

CVE-2026-9103 Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabl...