CVE-2026-15989 Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...

CVE-2026-76143

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...

CVE-2026-76143

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter. The provided documents do not specify the exact affected version, the specific component or file involved, or the specific remediation steps....

EUVD-2026-90485

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...

PT-2026-103743

Name of the Vulnerable Software and Affected Versions WPC Shop as a Customer for WooCommerce versions prior to 2.0.1 Description This issue allows for privilege escalation via account takeover. An authenticated attacker can gain full Administrator-level access to a site by supplying an...

Rocky Linux 8 [CIQ] Security Update: gnome-shell / gnome-shell-debuginfo / gnome-shell-debugsource (crlsa-2022_1814)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221814 advisory. gnome-shell: Password from logged-out user may be shown on login screen CVE-2020-17489 Tenable has extracted the preceding description block directly from the CIQ...

PT-2026-103678

Name of the Vulnerable Software and Affected Versions Genian SSL PNS affected versions not specified Description A missing authorization issue in the public-facing VPN/ZTNA gateway allows an attacker to bypass multi-factor authentication MFA by manipulating a login request parameter. This could...

AlmaLinux 9.2 [TuxCare] Security Update: kbd / kbd-legacy / kbd-misc (ALMALINUX9.2:CLSA-2026:1788600455)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788600455 advisory. - openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the...

Rocky Linux 9 [CIQ] Security Update: kbd / kbd-debuginfo / kbd-debugsource / kbd-legacy / kbd-misc (crlsa-2026_57610)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202657610 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...

PT-2026-105913

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

CVE-2026-76143: Missing Authorization

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...

PT-2026-105584

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth...

PT-2026-105606

ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...

PT-2026-103714

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before email success msg function whitelisting the client-submitted 'role' key and copying it into the...

PT-2026-103717

Name of the Vulnerable Software and Affected Versions The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform versions prior to 2.15.1 Description An authentication bypass exists in the login customer after checkout function via the checkout form parameter. The issue occurs because the...

PT-2026-105818

Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Details python lightrag/api/lightrag server.py:2161 @app.post"/login" async def loginform data: OAuth2PasswordRequestForm =...

PT-2026-103952

Name of the Vulnerable Software and Affected Versions Tapo C120 v1 Tapo C200 V5 Description Insufficient protection of login challenge data and lack of sanitization of attacker-controlled input processed by the MacTool handler allow an unauthenticated attacker on the same local network to replay...

Rocky Linux 10.2 [CIQ] Security Update: kbd / kbd-debuginfo / kbd-debugsource / kbd-legacy / kbd-misc (crlsa-2026_57597)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202657597 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...

PT-2026-105184

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

Rocky Linux 10.2 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_54178)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654178 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6...