CVE-2026-124006

The XWEB EVO product (versions through 5.8.8 ) contains a predictable credential generation vulnerability. Attackers can derive the Linux root password by computing a fixed prefix combined with a daily password value. Prior to version 5.7.0, this credential was identical across all units; from ve...

CVE-2026-124006 Dixell/Copeland XWEB EVO Predictable Root Password Generation

XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical...

CVE-2025-63353

CVE-2025-63353: Predictable Wi-Fi Password Vulnerability in FiberHome GPON ONT Devices References Based on research by Hanianis original CVE disclosure at CVE-2025-63353 Thanks to the security researchers who identified this vulnerability. Legal Disclaimer This information is provided for...

CVE-2026-119980

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because getdummyuserpassowrd derives the...

CVE-2026-119980 UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because getdummyuserpassowrd derives the...

CVE-2026-119980 UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because getdummyuserpassowrd derives the...

EUVD-2026-114605

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because getdummyuserpassowrd derives the...

CVE-2026-119980

The UsersWP plugin for WordPress (versions up to and including 1.2.78 ) is vulnerable to unauthorized account access due to the use of predictable passwords. The get_dummy_user_passowrd() function derives a shared password for 25 built-in dummy accounts from a hash that is simultaneously leaked i...

CVE-2026-119980: stiofansisland: The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is…

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because getdummyuserpassowrd derives the...

PT-2026-134459

Name of the Vulnerable Software and Affected Versions UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions prior to 1.2.79 Description Unauthorized account access is possible due to the use of predictable passwords for built-in dummy us...

CVE-2026-46347

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy...

CVE-2026-46347 Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy...

CVE-2026-46347 Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy...

CVE-2026-46347 Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy...

CVE-2026-46347

The Goobi viewer web application (versions prior to 26.05 ) is vulnerable to account takeover due to a predictable replacement password generation mechanism during the password reset process. The root cause is insufficient entropy , which allows an attacker to brute-force the generated password i...

CVE-2026-63159

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1login.password, a deterministic and reusable value. Attackers can derive or brute-force the reset...

CVE-2026-63159 Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1login.password, a deterministic and reusable value. Attackers can derive or brute-force the reset...

CVE-2026-63159

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1login.password, a deterministic and reusable value. Attackers can derive or brute-force the reset...

CVE-2026-63159 Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1login.password, a deterministic and reusable value. Attackers can derive or brute-force the reset...

CVE-2026-63149

The Omnispace Agora Project versions prior to 26.10.0 are vulnerable to an insecure randomness flaw. The issue stems from the use of PHP's uniqid() function within Txt::defaultPassword() to generate temporary or default account passwords. Because uniqid() is based on the server time in microsecon...