PT-2026-68051

Name of the Vulnerable Software and Affected Versions Typemill affected versions not specified Description The login endpoint 'POST /tm/login' using the login function in ControllerWebAuth lacks rate-limiting, failed-attempt counting, and account lockout mechanisms when the captcha is disabled,...

CVE-2026-71213: Improper Restriction of Excessive Authentication Attempts

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

CVE-2026-20289: Insertion of Sensitive Information into Log File

A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging...

CVE-2026-21766: Insufficiently Protected Credentials

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default...

CVE-2026-18958: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the...

CVE-2026-48911: Missing Authentication for Critical Function

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into...

CVE-2026-16442: Origin Validation Error

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

CVE-2026-15210: Improper Authentication

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

PT-2026-67970

Name of the Vulnerable Software and Affected Versions OTP Login With Phone Number, OTP Verification WordPress plugin versions prior to 1.8.71 Description An issue exists where the plugin fails to limit the number of OTP verification attempts and does not invalidate a one-time login code after an...

PT-2026-68314

Name of the Vulnerable Software and Affected Versions HCL Digital Experience affected versions not specified HCL Digital Experience Compose affected versions not specified Description The default login portlet insufficiently protects credentials. Under specific configurations and use cases,...

PT-2026-68242

Name of the Vulnerable Software and Affected Versions Cisco RoomOS affected versions not specified Description A flaw in the logging subsystem allows an authenticated local attacker with low privileges to access sensitive data. The issue occurs because the system logs sensitive information. By...

PT-2026-68187

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.2 Description Insufficient Verification of Data Authenticity in the external-login email binding flow. A missing authorization check allows unauthenticated attackers to take over arbitrary user accounts by...

PT-2026-68065

Name of the Vulnerable Software and Affected Versions Rancher Manager affected versions not specified Description When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. This occurs because the audit...

PT-2026-68043

Name of the Vulnerable Software and Affected Versions changedetection.io affected versions not specified Description The '/login' endpoint fails to implement per-IP or per-session rate limiting, failed-attempt counters, or account lockouts when verifying passwords against a PBKDF2-HMAC-SHA256 has...

LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-Based Web Agents

LLM-based web agents automate user tasks by observing webpages and executing browser actions on behalf of users. As these agents operate on real web services, login becomes a sensitive authentication boundary because it involves credentials and sensitive information. Existing work shows that...

CVE-2026-71205: Improper Restriction of Excessive Authentication Attempts

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt...

PT-2026-67974

Name of the Vulnerable Software and Affected Versions miniOrange 2FA WordPress plugin versions prior to 6.2.7 Description The plugin fails to bind the second factor configured during the pre-login two-factor challenge to the existing factor of the target account. This allows an attacker who...

CVE-2026-70594

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...

Ghost: Session Fixation in Ghost Admin

Impact Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. Vulnerable versions This vulnerability is present in Ghost fro...

CVE-2026-70594 Ghost: Session Fixation in Ghost Admin

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...