CVE-2026-81888

@hono/oauth-providers , authentication middleware for the Hono web framework, has a flaw in its OAuth state validation. Prior to version 0.8.6 , the built-in social login providers accept an OAuth callback even when the state value is absent on both the expected and received sides, causing the an...

EUVD-2026-68770

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81888

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the "state" value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

Malicious code in spc-grafeno-login (npm)

Source: amazon-inspector 01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2 The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, it enumerates process.env for keys matching...

Malicious code in spc-grafeno-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2 The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, ...

MAL-2026-15633 Malicious code in spc-grafeno-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2 The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, ...

WordPress SAML Single Sign On – SSO Login plugin <= 5.4.6 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Tanishq Shah, Thatchapol Booranatanit AliceZz in WordPress Plugin SAML SP Single Sign On versions = 5.4.6...

CVE-2026-82611

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument UUSERNAME causes sql injection. The...

CVE-2026-82610

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument empemail results in sql injection. It is possible to...

CVE-2026-82611 itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument UUSERNAME causes sql injection. The...

CVE-2026-82611

A SQL injection vulnerability exists in the Customer::cusAuthentication function of the /login.php file (Customer Login Interface) in itsourcecode Online Medicine Delivery System 1.0 . Manipulation of the U_USERNAME parameter allows a remote, unauthenticated attacker to inject SQL queries. The ex...

EUVD-2026-68339

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument UUSERNAME causes sql injection. The...

CVE-2026-82610 itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument empemail results in sql injection. It is possible to...

CVE-2026-82610

itsourcecode Online Medicine Delivery System 1.0 is affected by a SQL injection in the Employee::employeeAuthentication function within /rider/login.php (Login Interface component). Manipulation of the emp_email argument allows an unauthenticated remote attacker to inject SQL, resulting in low im...

EUVD-2026-68338

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument empemail results in sql injection. It is possible to...

PT-2026-83692

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument U USERNAME causes sql injection. The...

PT-2026-83687

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument emp email results in sql injection. It is possible to...

PT-2026-84029

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

Important: kbd

Issue Overview: openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the...

Important: kbd

Issue Overview: openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the...