CVE-2026-32825

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...

CVE-2026-54685

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username...

CVE-2026-54685 FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username...

CVE-2026-54685

FileBrowser Quantum exposes a timing-side-channel in the /api/auth/login endpoint prior to version 1.3.2-beta, allowing unauthenticated users to distinguish valid usernames from invalid ones via response-time differences (bcrypt path for valid usernames). A PoC demonstrates the attack, and the is...

CVE-2026-54685 FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username...

CVE-2026-54685

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the "/api/auth/login" authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a "401"/"403" response almost immediately. When a valid...

CVE-2026-13142

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a...

CVE-2026-13142

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin by VentraConnect is vulnerable in versions prior to 1.4.1 . The flaw stems from a lack of rate limiting and functional attempt lockouts on its passwordless email one-time-password (OTP) verification system. Additionally, the plug...

CVE-2026-13142

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a...

CVE-2026-13142 Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a...

CVE-2026-13142 Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a...

EUVD-2026-45888

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a...

PT-2026-61631

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...

Linux Distros Unpatched Vulnerability : CVE-2026-63887

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput concatenates key=value\0 records into login-rspbuf, an 8192-byte...

CVE-2026-54685: Observable Timing Discrepancy

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username...

CVE-2026-32825: Improper Restriction of Excessive Authentication Attempts

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...

CVE-2026-13142: Improper Privilege Management

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a...

PT-2026-61531

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a...

CVE-2026-63887

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput concatenates "key=value\0" records into login-rspbuf, an 8192-byte kzallocMAXKEYVALUEPAIRS buffer allocated in iscsitallocloginsetupbuffer...

CVE-2026-63887 scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput concatenates "key=value\0" records into login-rspbuf, an 8192-byte kzallocMAXKEYVALUEPAIRS buffer allocated in iscsitallocloginsetupbuffer...