EUVD-2026-93923

When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...

CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7

CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7 Description A vulnerability in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies. Impact Weak Passwords Accepted: Attackers can guess simple passwords or use...

CVE-2026-104181

The Filament full-stack components for Laravel are vulnerable in versions 4.0.0 through 4.13.3 and 5.8.3 . The root cause is that app-based multi-factor authentication (MFA) management actions do not consistently require the current password for confirmation. An attacker with access to an authent...

CVE-2026-24061_Lab

CVE-2026-24061 Telnetd Lab This repository contains a simple Docker lab to demonstrate the CVE-2026-24061 vulnerability. It allows authentication bypass and root access on GNU telnetd, on Linux. The purpose is exclusively educational. Requirements Docker installed Telnet Client installed Building...

CVE-2026-74864: Authorization Bypass Through User-Controlled Key

sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...

PT-2026-86936

Name of the Vulnerable Software and Affected Versions knowns versions prior to 0.30.0 Description The management API is served without authentication on all network interfaces by default, requiring no password on fresh installations. This allows attackers to access the unauthenticated...

UBUNTU-CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

Brazil Health Surveillance Database Exposed 79GB of Sensitive Records

Brazil's SISVISA health surveillance system left 102,215 files totaling 79GB open online, including tax IDs and identity documents, without password protection...

EUVD-2026-52409

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...

CVE-2026-67599

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...

CVE-2026-67609 Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in...

CVE-2026-67609 Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in...

CVE-2026-6890

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

EUVD-2026-51379

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

📄 WordPress Booking Activities 1.16.43 Authentication Bypass

WordPress Booking Activities plugin version 1.16.43 contains an authentication bypass vulnerability through Login Without Password. A remote attacker can authenticate without valid credentials and access protected functionality. This proof of concept exploit demonstrates the vulnerable request fl...

CVE-2026-44986

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teamsinvitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session base...

CVE-2026-44986 Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teamsinvitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session base...

FacturaScripts: Account takeover of any 2FA-enabled user

Authentication bypass in FacturaScripts: /login?action=two-factor-validation accepts brute-forceable TOTP without password or CSRF protection Summary Core/Controller/Login.php::twoFactorValidationAction accepts an unauthenticated POST containing only fsNick and fsTwoFactorCode. If the TOTP value...

PT-2026-60077

Authentication bypass in FacturaScripts: /login?action=two-factor-validation accepts brute-forceable TOTP without password or CSRF protection Summary Core/Controller/Login.php::twoFactorValidationAction accepts an unauthenticated POST containing only fsNick and fsTwoFactorCode. If the TOTP value...

CVE-2026-8926

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username without a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is n...