46769 matches found
PT-2026-79312
Name of the Vulnerable Software and Affected Versions Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress versions prior to 4.8.7 Description An authentication bypass exists because the handle email otp return function returns a secret magic...
AlmaLinux 9 : kbd (ALSA-2026:57610)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57610 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...
RockyLinux 10 : kbd (RLSA-2026:57597)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57597 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...
RockyLinux 9 : kbd (RLSA-2026:57610)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57610 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...
AlmaLinux 10 : kbd (ALSA-2026:57597)
The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57597 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...
kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...
GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...
kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...
Moderate: Red Hat Security Advisory: kbd security update
An update for kbd is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
CVE-2026-64961
ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...
EUVD-2026-63361
ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...
CVE-2026-64961 Authentication Bypass in ATutor
ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...
CVE-2026-64961
ATutor (a learning management system) is vulnerable to authentication bypass in its auto-login functionality. Although a token validation check exists, the values required for token validation remain uninitialized in certain code paths , allowing an unauthenticated attacker who knows a user's ide...
CVE-2026-64961
ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...
CLSA-2026-1787232011 dovecot: Fix of CVE-2026-27858
CVE-2026-27858: fix pre-auth memory exhaustion in managesieve-login from an oversized AUTHENTICATE initial response...
CLSA-2026-1787231577 dovecot: Fix of CVE-2026-27858
CVE-2026-27858: fix pre-auth memory exhaustion in managesieve-login from an oversized AUTHENTICATE initial response...
CVE-2026-66594
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...