CVE-2026-67437

OliveTin: The CVE-2026-67437 issue is in the OAuth2 login path (service/internal/auth/otoauth2/restapi_auth_oauth2.go) where per-login state is stored in an unbounded registeredStates map on every /oauth/login request. This can allow an unauthenticated attacker to exhaust memory and cause a denia...

Buying TikTok views or followers? Here’s what you’re really getting

A whole industry has sprung up around selling TikTok "growth." Cheap views by the hundred, pre-made ad accounts, and polished sales pages promising a repeatable path to serious revenue. None of it is officially sanctioned by TikTok, and depending on what you're buying, you could end up wasting...

EUVD-2026-50404

A vulnerability in the web interface of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presen...

CVE-2026-20316 Cisco Secure Firewall Management Center Software Static Credential Vulnerability

A vulnerability in the web interface of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presen...

CVE-2026-20316 Cisco Secure Firewall Management Center Software Static Credential Vulnerability

A vulnerability in the web interface of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presen...

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

A vulnerability in the web interface of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presen...

CVE-2026-65888

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-66400

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...

EUVD-2026-50356

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-65888

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-65888

The CVE concerns Joomla extension Gridbox by balbooa.com, with versions older than 2.20.2. The underlying issue is a vulnerability in the socialLogin method that can allow an attacker to log in as any user on the target site, i.e., an account takeover. The CVSS 4.0 score is 10.0 (CRITICAL) with n...

CVE-2026-66400 Grav Login Plugin before 3.8.13 Insufficient Session Expiration

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...

CVE-2026-66400

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...

EUVD-2026-50324

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...

CVE-2026-66400 Grav Login Plugin before 3.8.13 Insufficient Session Expiration

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...

CVE-2026-66400

Grav Login Plugin = 3.8.13 or follow vendor advisories cited in the references to mitigate.

CVE-2026-50641

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

CVE-2026-50641

Streamsoft Business Intelligence (BI) stores users’ passwords in plaintext in the database. The issue is mitigated in version 6.8.0.0, and users were also prompted to change their password on first login. Impact is Confidentiality (high) with no reported impact to integrity or availability. The a...