755 matches found
Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite
Hoppscotch self-hosted backend = 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWTSECRET to forge tokens and fully compromise the server, exploit requires attacker to access...
ZimaOS - Authentication Bypass
ZimaOS = 1.5.0 contains a broken authentication caused by improper password validation for known system service accounts in the login function, letting attackers authenticate with any password for these accounts, exploit requires knowledge of common usernames. id: CVE-2026-21891 info: name: ZimaO...
WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by HaiND in WordPress Plugin Ezoic versions = 2.22.11...
CVE-2026-66465
Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...
CVE-2026-66453
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
CVE-2026-28185
Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...
CVE-2026-28008
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...
EUVD-2026-57884
Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...
CVE-2026-66465
Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...
CVE-2026-66465
CVE-2026-66465 affects WordPress Cartify theme (Cartify Multipurpose) versions up to and including 1.3.0.1, with unauthenticated broken authentication that can lead to account takeover. The connected documents confirm the vulnerability type and the affected version range but do not provide remedi...
CVE-2026-66465 WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability
Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...
CVE-2026-66453
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
EUVD-2026-57873
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
CVE-2026-66453 WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
CVE-2026-66453
CVE-2026-66453 affects the WordPress Salon Booking System plugin,
CVE-2026-28185
Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...
CVE-2026-28185
The CVE-2026-28185 entry concerns the WordPress plugin “Login with Google” (
CVE-2026-28185 WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...