CVE-2026-18470

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

CVE-2026-18469

The Login & Register Forms WordPress plugin (versions before 4.0.2 ) is vulnerable to an unauthenticated account takeover. The flaw exists because the plugin fails to enforce password reset attempt limits against a server-derived value; instead, it keys both the verification code and the per-sour...

CVE-2026-18468

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...

CVE-2026-18470 Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

CVE-2026-18470 Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

CVE-2026-18470

The Login & Register Forms WordPress plugin (versions before 4.0.2 ) is vulnerable to unauthenticated email address disclosure . The root cause is a failure to verify that password reset requests originate from the actual account owner, combined with inadequate redaction of the response address. ...

CVE-2026-18468

The Login & Register Forms WordPress plugin, in versions prior to 4.0.2 , is vulnerable to an unauthenticated account takeover . The root cause is that the plugin fails to bind the password reset verification state to the specific account being reset or the party completing the verification; inst...

CVE-2026-18468 Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...

CVE-2026-18469 Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force

The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will...

PT-2026-69571

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture where the saved value of register x0 is not kept in sync with updates made by a tracer. On arm64, register x0 holds both the first argument of a...

CVE-2026-68293: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords 128 bytes when the device advertises the mcia32dwords capability, but struct mlx5ifcmciaregbits only defines dword0..11,...

CVE-2026-68274: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask gdssmask to determine the number of entries to allocate: total =...

CVE-2026-18468: Improper Authentication

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...

CVE-2026-18470: Exposure of Sensitive Information to an Unauthorized Actor

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

PT-2026-69371

Name of the Vulnerable Software and Affected Versions Login & Register Forms versions prior to 4.0.2 Description When the verification-code reset mode is enabled, the plugin fails to enforce password reset attempt limits using a server-derived value. Instead, it relies on client-controlled data f...

PT-2026-69372

Name of the Vulnerable Software and Affected Versions Login & Register Forms versions prior to 4.0.2 Description The plugin fails to verify if a password reset request originates from the actual account owner. Additionally, it does not properly redact the address in the response, which enables...

PT-2026-69370

Name of the Vulnerable Software and Affected Versions Login & Register Forms versions prior to 4.0.2 Description An issue exists where the password reset verification state is not bound to the account being reset or the party completing the verification. Instead, the state is keyed on a value...

PT-2026-69693

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow exists in the net/mlx5 component. When a device advertises the mcia 32dwords capability, the MCIA register can return up to 32 dwords 128 bytes. However, the mlx5 ifc...

PT-2026-69839

Name of the Vulnerable Software and Affected Versions systemd-machined versions 258 through 259 and later Description When running on a desktop system, an unprivileged user logged into a desktop graphical session can terminate arbitrary processes, including those with higher privileges. This issu...

CVE-2026-18469: Improper Authentication

The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will...