BIT-PARSE-2026-39321 Parse Server has a login timing side-channel reveals user existence

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0 and 8.6.74, he login endpoint response time differs measurably depending on whether the submitted username or email exists in the database. When a user is not found, the server...

EUVD-2026-20896

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldapescape. An unauthenticated attacker can inject LDAP filter metacharacters into the username field ...

CVE-2026-34578

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldapescape. An unauthenticated attacker can inject LDAP filter metacharacters into the username field ...

Scammers pose as Amazon support to steal your account

Cybercriminals using the so-called "spray and pray" tactic love to impersonate well-known brands. Especially ones with huge customer bases. Amazon reportedly has around 310 million active customers, so they certainly qualify as a brand worth impersonating. And it shows in the sheer volume of scam...

SUSE-SU-2026:21158-1 Security update for util-linux

This update for util-linux fixes the following issues: Security issues: - CVE-2025-14104: heap buffer overread in setpwnam when processing 256-byte usernames bsc1254666. - CVE-2026-3184: access control bypass due to improper hostname canonicalization in login bsc1258859. Non security issues: -...

SUSE-SU-2026:21016-1 Security update for util-linux

This update for util-linux fixes the following issues: Security issues: - CVE-2025-14104: heap buffer overread in setpwnam when processing 256-byte usernames bsc1254666. - CVE-2026-3184: access control bypass due to improper hostname canonicalization in login bsc1258859. Non security issues: -...

OPENSUSE-SU-2026:20495-1 Security update for util-linux

This update for util-linux fixes the following issues: Security issues: - CVE-2025-14104: heap buffer overread in setpwnam when processing 256-byte usernames bsc1254666. - CVE-2026-3184: access control bypass due to improper hostname canonicalization in login bsc1258859. Non security issues: -...

WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion

The Clean Login plugin for WordPress up to version 1.14.5 contains a path traversal caused by the 'template' attribute in the clean-login-register shortcode, letting authenticated attackers with contributor access include and execute arbitrary files, exploit requires attacker to have contributor ...

SUSE-RU-2026:1228-1 Recommended update for shadow

This update for shadow fixes the following issues: shadow is updated to 4.17.2 to bring lots of features and bug fixes. - util-linux-2.41 introduced new variable: LOGINENVSAFELIST. Recognize it and update dependencies. - Set SYSUID,GIDMIN to 201: After repeated similar requests to change the ID...

util-linux: util-linux: Access control bypass due to improper hostname canonicalization

A flaw was found in util-linux. Improper hostname canonicalization in the login1 utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAMRHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing...

CVE-2025-70810

Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism...

Deciso OPNsense security vulnerabilities

Deciso OPNsense is a set of open-source firewall and routing software based on FreeBSD developed by the Dutch company Deciso. Prior to version 26.1.6, there were security vulnerabilities in OPNsense. These vulnerabilities stemmed from the LDAP authentication connector, which directly passed the...

CVE-2025-70810: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism...

EUVD-2025-209383

Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism...

PT-2026-31667

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS,...

PT-2026-31730

Name of the Vulnerable Software and Affected Versions Joomla Solidres version 2.13.3 Description Joomla Solidres 2.13.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts. Attackers can manipulate multiple GET parameters,...

PT-2026-31617

Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism...

CVE-2025-70810

The web forum software phpBB 3.3.15 is susceptible to a Cross Site Request Forgery (CSRF) vulnerability within its login function and authentication mechanism . This flaw allows a local attacker to achieve arbitrary code execution . While the vulnerability is categorized as CSRF, the documents sp...

📄 Spectrum ANOG Device Credential Extraction / Command Injection

This Metasploit auxiliary module targets Spectrum/ANOG devices and combines credential extraction, password decryption, and remote command execution through an authenticated command injection flaw...

CVE-2026-39985: URL Redirection to Untrusted Site

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS,...