CVE-2026-105211

ZITADEL versions before 4.17.1 are vulnerable to an authentication bypass in Login V2 . This flaw allows unauthenticated attackers to intercept OTP codes delivered via the returnCode delivery type. By knowing a victim's login name who has OTP-Email and OTP-SMS enrolled, an attacker can read both ...

CVE-2026-105211 ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes...

EUVD-2026-92104

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes...

PT-2026-104635

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 4.17.1 Description An authentication bypass exists in Login V2 that allows unauthenticated attackers to take over accounts. Attackers who know the login name of a victim enrolled in OTP-Email and OTP-SMS can obtain...

CVE-2026-97074

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

CVE-2026-97074 WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

EUVD-2026-89894

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

CVE-2026-97074 WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

CVE-2026-97074

The Newsletters, Email Marketing, SMS and Popups by Omnisend WordPress plugin versions

WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Elaprendiz1927 in WordPress Plugin Newsletters, Email Marketing, SMS and Popups by Omnisend versions = 1.9.0...

PT-2026-103226

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

CVE-2026-97074: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

WordPress miniOrange OTP Login, Verification and SMS Notifications plugin <= 5.5.5 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Supakiad S. m3ez in WordPress Plugin miniorange otp verification versions = 5.5.5...

Exploit for CVE-2026-85984

CVE-2026-85984 — miniOrange OTP Login Auth Bypass Python 3...

CVE-2026-85984

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

CVE-2026-85984 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

CVE-2026-85984 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

EUVD-2026-87786

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

CVE-2026-85984

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (versions up to and including 5.5.5 ) is vulnerable to an Authentication Bypass . The root cause is a missing password-intent guard in the mo_by_pass_login() function when the skip_pass_fallback configuration is ena...

CVE-2026-100571

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...