CVE-2026-79763

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

EUVD-2026-86120

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

extloader

extLoader Un pequeño kit de herramientas para gestionar e implementar extensiones de Chromium desempaquetadas. Obtén más información en el siguiente artículo: https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways Instalación Instalación...

kentico-xperience13-AuthBypass-wt-2025-0006

WT-2025-0006 CVE aún no asignado Kentico Xperience 13 CMS - Comprobación de omisión de autenticación del servicio de staging Detección en acción root@kitploit: python3 watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0006.py -H http://labcms / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / /...

enumpossible

enumpossible Verifica una lista de servidores SSH para determinar la disponibilidad de autenticación basada en contraseña y la existencia de la vulnerabilidad de enumeración de usuarios SSH CVE-2018-15473 en los identificados. Utiliza una versión ligeramente modificada de...

CVE-2023-50564

CVE-2023-50564 如何使用 首先设置一个监听器用于接收反弹shell。 终端1 root@kitploit: nc -nlvp 执行脚本，该脚本会尝试安装一个pluck模块，将反弹shell发送回我们。 终端2 root@kitploit: go run exploit.go -url -password -i -p...

CVE-2026-19641

CVE-2026-19641 affects Arista EOS devices where password-based login authentication is enabled (e.g., SSH password or Telnet). Due to CWE-116 (Improper Encoding or Escaping) , a specially crafted password can create orphan authentication sessions that accumulate in a limited session pool, eventua...

CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then any password will successfully match during authentication, instead of being inactive. This flaw allows an attacker to successfully authenticate as a user whose password h...

Security Advisory 0152

Security Advisory 0152 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-19641 CVSSv3.1 Base Score: 5.3...

CVE-2026-76940

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-76940

CVE-2026-76940 affects the Ebyte NE2-D11 device, which does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This lack of control allows an attacker to perform automated password-based authentication attacks against deployments relying on such aut...

CVE-2026-76940 Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

GO-2026-6169 WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile...

SUSE-SU-2026:3526-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598: integer overflow in function userauthpassword of file src/userauth.c bsc1263890. - CVE-2026-58050: heap buffer...

SUSE CVE-2026-45327

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a ?password= query parameter, comparing the supplied...

CVE-2026-12255

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

EUVD-2026-49065

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

PT-2026-64832

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...