CVE-2026-71237

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $POST'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='$username' and password='$password' limit 1". The username value is...

CVE-2026-71231 IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

CVE-2026-71231 IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

CVE-2026-71231

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the copyReqBody function in pkg/auth/audit/log.go. An attacker can exhaust server memory and crash the Rancher Manager process by sending arbitrarily large HTTP request bodies...

Malicious code in @zzzgenesis00/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 985d4d8e5069084334daa08512249314d36d9fa8662adef050021c2400dacbdd @zzzgenesis00/[email protected] impersonates the Solana SPL Token package and runs postinstall.js on npm install. The script harvests host...

CVE-2026-71213

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

CVE-2026-71205

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt...

CVE-2026-59675

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

CVE-2026-59675 Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

CVE-2026-59675

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

EUVD-2026-53291

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

CVE-2026-59675

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

CVE-2026-59675

CVE-2026-59675 affects Rancher Manager when API audit logging is enabled. The audit middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because it is positioned earlier than Rancher’s APIBodyLimitingHandler, the default 1 MiB body cap is by...

CVE-2026-59675 Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

CVE-2026-59675 Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

Kali365 Exploits Microsoft Device Login to Access US Corporate Data

Learn how Kali365 has been abusing Microsoft device login to gain OAuth tokens, targeting US firms, and how SOC teams can detect, hunt, and stop these phishing attacks...

CVE-2026-16036

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled...

CVE-2026-16055

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Galle...

CVE-2026-15210

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...