CVE-2026-53654 Grav: Unauthenticated open redirect via login twofa_cancel _redirect

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

UBUNTU-CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WordPress Persistent Login versions = 3.1.0...

CVE-2026-76048

SourceCodester Simple Online Food Ordering System 1.0 contains a SQL injection vulnerability in the Username parameter of /admin/ajax.php?action=login. A remote, unauthenticated attacker can exploit this to compromise confidentiality, integrity, and availability of the application. A proof-of-con...

EUVD-2026-62226

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit h...

CVE-2026-76048 SourceCodester Simple Online Food Ordering System ajax.php login sql injection

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit h...

PT-2026-78674

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1 Description The login endpoint in crates/api/api/src/local user/login.rs exhibits a response discrepancy based on the existence of a user account. The function...

Linux Distros Unpatched Vulnerability : CVE-2026-1199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent...

PT-2026-78264

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description A remote SQL injection flaw exists in the /admin/ajax.php?action=login endpoint. The issue occurs when the Username argument is manipulated, allowing an attacker to...

PT-2026-78487

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11 Description The login.regenerate2FASecret task fails to verify if a user is authorized, checking only for the existence of a pending-session user. An attacker who has obtained a victim's password can...

SUSE CVE-2026-1199

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...

CVE-2026-73529

Plainpad (≤1.1.1) has dead code in App\Http\Kernel.php under the Laravel 11+ skeleton, leaving the throttle config unattached to POST /v1/sessions, allowing unlimited unauthenticated credential attempts and CPU exhaustion via bcrypt comparisons. Fixed in commit d3823fc595b5d8f842a6fd7dfe49b7852a1...

CVE-2026-73529 Plainpad Missing Rate Limiting via POST /v1/sessions

Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleto...

CVE-2026-73351

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...

CVE-2026-66640

Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...

EUVD-2026-60778

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...

CVE-2026-73351 WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...

CVE-2026-73351

Unauthenticated XSS affects the WordPress Social Login and Register plugin at version 7.8.1 or earlier (CVSS 7.1, HIGH). No specific affected component or remediation version is provided; update to a newer plugin release when available.