CVE-2026-89624: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universalpidffprobe starts the device with hidhwstart and then, if force-feedback initialisation fails, returns the error through a label that only does "return...

PT-2026-90340

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free write occurs in the Linux kernel when force-feedback initialization fails within the universal pidff probe function. The function starts the device using hid hw start, b...

CVE-2026-12215: Unrestricted Upload of File with Dangerous Type

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...

PT-2026-89797

Name of the Vulnerable Software and Affected Versions Smart Video Intercom System affected versions not specified Description Kingdom Communication Associated developed a system that lacks brute-force protection. This allows unauthenticated remote attackers to gain access to valid accounts by...

CVE-2026-89174: Improper Restriction of Excessive Authentication Attempts

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

PT-2026-89747

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in process otp form is keyed exclusively on the attacker-controlled...

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770

Keycloak 's Device Authorization Grant flow contains a flaw where the token redemption process does not verify whether a user account is currently locked due to brute-force protection . An attacker holding an active session for a locked account can complete the device login flow and obtain new se...

CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

EUVD-2026-75289

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-77771

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

EUVD-2026-75264

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

AVEVA Pipeline Integrity Monitor

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes, or run arbitrary code in a browser session. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these...

PT-2026-89292

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

PT-2026-89299

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-81822

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user...

CVE-2026-81822

CVE-2026-81822 affects AVEVA Pipeline Integrity Monitor (PIMBoards) due to the use of a broken or risky cryptographic algorithm in its app-native password storage. An attacker with read access to PIMBoards project files can computationally brute-force the weak password hashes to recover user cred...

CVE-2026-86729

WWBN AVideo through commit e01e41ecc no patched version available exposes getapipreauthorize in plugin/API/API.php as a second, undocumented login path. Unlike getapisignIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit, getapipreauthorize performs the same credentia...