CVE-2026-90976 Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...

WordPress Clean Login plugin < 1.19 - Unauthenticated Account Creation with Registration Disabled vulnerability

Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Artus KG in WordPress Plugin Clean Login versions 1.19...

CVE-2026-85123

The Easy Form Builder by WhiteStudio WordPress plugin, versions 4.0.0-4.1.3 , is vulnerable to an unauthenticated registration policy bypass . The flaw exists because the plugin fails to validate submitted values against stored configurations for certain form types, specifically involving Login F...

EUVD-2026-82666

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...

CVE-2026-85123 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...

PT-2026-95263

Name of the Vulnerable Software and Affected Versions Clean Login WordPress plugin versions prior to 1.19 Description The plugin fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass anti-automation controls on the registratio...

CVE-2026-90976: Improper Access Control

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...

PT-2026-95636

Name of the Vulnerable Software and Affected Versions cockpit-files affected versions not specified Description A race condition exists during directory creation with owner assignment. A local unprivileged attacker who controls a writable parent directory can replace a newly created directory wit...

PT-2026-95262

Name of the Vulnerable Software and Affected Versions Clean Login WordPress plugin versions prior to 1.19 Description The registration handler in the plugin fails to verify if user registration is enabled on the site. This allows unauthenticated users to create accounts even when the site...

CVE-2026-90977: Incorrect Comparison

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

WP < 7.1.1 - Contributor+ Arbitrary Post Modification

Description WordPress does not properly verify that a user is allowed to edit a post when handling a post creation request that names an existing post in some cases, which could allow users with a role as low as contributor to overwrite the title, content and author of any post, including those...

CVE-2026-91205: Race Condition Enabling Link Following

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...

oras-go extractTarDirectory ensureLinkPath Unauthorized Access

The vulnerability of the extractTarDirectory and ensureLinkPath functions in the content/file.Store component of the oras-go library is related to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to create and...

EUVD-2026-82468

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

CVE-2026-54907

Caddy Proxy Manager , a web interface for managing Caddy Server reverse proxies and certificates, enabled email and password self-registration by default (at /api/auth/sign-up/email) prior to version 1.5.1 . This allowed an unauthenticated remote actor to create an active account with the user ro...

EUVD-2026-52281

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure...

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified Class::method string, letting an account with only page-editing rights admin.pages, not super-admin plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP...

Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

Summary LocalFolderExtractor validates only the final canonical file path before extraction. However, makeFile creates intermediate directories one path segment at a time without checking whether each created directory remains inside the destination folder. A malicious RAR entry can make the fina...

WordPress CheckView plugin < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass vulnerability

Administrator Account Creation via REST API Authentication Bypass vulnerability discovered by Usama Arshad in WordPress Plugin CheckView Automated Testing versions 2.3.2...

CVE-2026-86864 pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...