WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WordPress Social Login and Register versions = 7.8.0...

CVE-2026-11922

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-11922

The CVE-2026-11922 entry describes a rate-limit bypass in zenml-io/zenml (versions 0.57.0–0.94.2). The issue arises because the rate limiter uses request.client.host (derived from the X-Forwarded-For header when Uvicorn is run with --proxy-headers --forwarded-allow-ips *), allowing an attacker to...

CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

EUVD-2026-48467

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-11922

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

VulnCheck KEV: CVE-2025-4283

A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Login.php?f=login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely...

PT-2026-64225

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-15981

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mosamlvalidatesignature function performing a loose boolean check on the raw tri-state integer returned by PHP's opensslverify, causing a...

CVE-2026-63359

The Appriss Insights Equifax Victim Information Notification Exchange VINE applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information...

CVE-2026-47669

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...

CVE-2026-15212

CVE-2026-15212 affects the WPO365 | Login plugin for WordPress (up to version 43.2). The root cause is that Ajax_Service::verify_ajax_request() gates wp_verify_nonce() behind the boolean option enable_nonce_check, which is missing from the default wpo365_options. This causes wp_ajax_wpo365_update...

CVE-2026-47669

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...

EUVD-2026-48368

The Appriss Insights Equifax Victim Information Notification Exchange VINE applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information...

CVE-2026-63359

CVE-2026-63359 affects Appriss Insights VINE applications. The vulnerability allows an unauthenticated attacker to send a specially-crafted request that bypasses the login page, access other users’ credentials, take over other user accounts, and dump sensitive PII and other database information. ...

CVE-2026-63359

The Appriss Insights Equifax Victim Information Notification Exchange VINE applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information...

CVE-2026-63359 Appriss Insights VINE SQLI

The Appriss Insights Equifax Victim Information Notification Exchange VINE applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information...

Appriss Insights VINE Application SQL Injection

RISK EVALUATION The Appriss Insights Equifax VINE applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information from the database. 2...

GO-2026-5989 Unauthenticated OIDC login in nebula-mesh allows unbounded memory allocation in github.com/forgekeep/nebula-mesh

When OIDC is enabled, the login endpoint is reachable without authentication and is registered outside the rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map. An unauthenticated remote client can grow the state storage, bounded by...