44588 matches found
PT-2026-105606
ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...
PT-2026-103714
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before email success msg function whitelisting the client-submitted 'role' key and copying it into the...
PT-2026-103717
Name of the Vulnerable Software and Affected Versions The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform versions prior to 2.15.1 Description An authentication bypass exists in the login customer after checkout function via the checkout form parameter. The issue occurs because the...
PT-2026-105818
Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Details python lightrag/api/lightrag server.py:2161 @app.post"/login" async def loginform data: OAuth2PasswordRequestForm =...
CVE-2026-76143: Missing Authorization
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...
Rocky Linux 10.2 [CIQ] Security Update: kbd / kbd-debuginfo / kbd-debugsource / kbd-legacy / kbd-misc (crlsa-2026_57597)
The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202657597 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...
PT-2026-103952
Name of the Vulnerable Software and Affected Versions Tapo C120 v1 Tapo C200 V5 Description Insufficient protection of login challenge data and lack of sanitization of attacker-controlled input processed by the MacTool handler allow an unauthenticated attacker on the same local network to replay...
PT-2026-105184
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...
Rocky Linux 8 [CIQ] Security Update: irssi / irssi-debuginfo / irssi-debugsource / irssi-devel (crlsa-2020_1616)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20201616 advisory. irssi: use after free when sending SASL login to server CVE-2019-13045 Tenable has extracted the preceding description block directly from the CIQ security advisory...
PT-2026-103678
Name of the Vulnerable Software and Affected Versions Genian SSL PNS affected versions not specified Description A missing authorization issue in the public-facing VPN/ZTNA gateway allows an attacker to bypass multi-factor authentication MFA by manipulating a login request parameter. This could...
CVE-2026-87004
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/authoidcprovider.py decodes the idtoken returned by the identity provider's token endpoint using jose.jwt.getunverifiedclaims...
CVE-2026-55181
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...
CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...
CVE-2026-55181
Prior to version 1.30.3 , Tugtainer (a self-hosted app for automating Docker container updates) contains a vulnerability where OIDC authentication can be initiated even when OIDC_ENABLED=false. While the /auth/oidc/enabled endpoint correctly reports that OIDC is disabled, a direct request to /aut...
EUVD-2026-90192
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...
CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...
CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...
USN-8858-1: Authen::SASL vulnerability
It was discovered that Authen::SASL, a Perl authentication library, did not properly validate login attempts. An attacker could possibly use this issue to gain unauthorized access...
OESA-2026-4164 python-jupyter-server security update
The backend for Jupyter web applications Security Fixes: Jupyter Server is the backend for Jupyter web applications. In jupyterserver versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler.redirectsafe, which allows redirects to arbitra...