CVE-2026-1199 API and Frontend login lockout race condition

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...

EUVD-2026-60732

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-75778

Task Management System 1.0 has a SQL injection in Operation::select_with_multiple_condition within /index.php of the Login Form; the email argument is unparameterized. CVSS 7.3 (HIGH), exploitable remotely with no auth; proof-of-concept exploit is publicly available. No patch or workaround is doc...

CVE-2026-75778 code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-75833

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

CVE-2026-75833

The Grav API plugin (bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 has an open redirect in SsoController::sanitizeReturnTo(): a backslash-prefix like /\evil.com bypasses the // guard and is normalized by browsers to //evil.com, enabling post-OAuth-login phishing. Exploitatio...

CVE-2026-75773

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

WordPress User Login History plugin <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'blogid' Parameter vulnerability discovered by Nikola Kojic - RAS-IT in WordPress Plugin User Login History versions = 2.1.7...

CVE-2026-75773

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

EUVD-2026-60580

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

CVE-2026-75773 karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

CVE-2026-75773

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

CVE-2026-75773

The vulnerability is in the authorize function of apps/web/server/auth.ts in karakeep up to 0.32.0, allowing unlimited login attempts on the remote Login Endpoint. It is rated CVSS 3.7 (LOW) with high attack complexity. Upgrading to 0.33.0 (patch f7d042971d0d2bcc7119654830cf1eb93eabbf24) resolves...

WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hackthesoul in WordPress Plugin WordPress Social Login and Register versions = 7.8.1...

WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Login With Ajax versions = 4.5.1...

WordPress Admin Custom Login plugin <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'Message Above Login Form' Setting vulnerability discovered by Ryoma Nishioka in WordPress Plugin Admin Custom Login versions = 3.6.4...

WordPress Backup Migration plugin < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login vulnerability

Admin+ Privilege Escalation via Post-Restore Auto-Login vulnerability discovered by Thanh Lam Tang in WordPress Plugin Backup Migration versions 2.1.7...

SUSE CVE-2026-72693

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

PT-2026-77287

Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in AppHttpKernel.php that is never instantiated under the Laravel 11+ skeleton,...

PT-2026-76965

Name of the Vulnerable Software and Affected Versions code-projects Task Management System version 1.0 Description An issue exists in the Login Form component within the /index.php file. Specifically, the Operation::select with multiple condition function is susceptible to SQL injection, a...