PT-2026-84401

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.5 Filament versions prior to 5.7.5 Description The login page presents the multi-factor authentication MFA challenge before evaluating the canAccessPanel function. For accounts where canAccessPanel denies access...

PT-2026-90014

USN-8688-1 fixed a vulnerability in PAM. This update provides the corresponding fix for PAM on Ubuntu 26.04 LTS. Original advisory details: Juthawong Naisanguansee discovered that PAM incorrectly cleared failed login attempt records when certain services invoked the account phase without first...

TencentOS Server 4: kbd (TSSA-2026:0868)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0868 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

PT-2026-84103

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl device id' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-18752: Improper Neutralization of Special Elements used in an SQL Command

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2023-54391: Missing Critical Step in Authentication

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

PT-2026-84529

Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment VE versions 7.0 through 8.0 Description An authentication bypass exists in libpve-access-control that allows unauthenticated attackers to authenticate as any enabled user who does not have a second factor configured...

VulnCheck KEV: CVE-2023-54391

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2026-82229

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

CVE-2026-61641 Wallos: OIDC account takeover via email-based account linking without `email_verified` check

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...

EUVD-2026-68812

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...

CVE-2026-82229 WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

CVE-2026-82229

An unauthenticated Cross Site Scripting (XSS) vulnerability affects the WordPress Social Login and Register plugin in versions 7.8.2 and earlier . The flaw was discovered by Patchstack researcher Ananda Dhakal and carries a CVSS 3.1 score of 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L...

CVE-2026-82229 WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

EUVD-2026-68798

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

GHSA-FM3F-CH8H-QW8Q @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...

CVE-2026-54599 Wallos: OIDC state parameter never validated — login CSRF / account takeover

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $SESSION'oidcstate', but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can...

CVE-2026-54599 Wallos: OIDC state parameter never validated — login CSRF / account takeover

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $SESSION'oidcstate', but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can...

CVE-2026-54599 Wallos: OIDC state parameter never validated — login CSRF / account takeover

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $SESSION'oidcstate', but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can...