CVE-2026-63329: Improper Encoding or Escaping of Output

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

CVE-2026-58272: Observable Timing Discrepancy

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

EUVD-2026-83650

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in...

CVE-2026-93961 Dromara UJCMS UserController UserController.java usernameExist improper authorization

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in...

CVE-2026-93961

An improper authorization flaw exists in the usernameExist function of UserController.java in Dromara UJCMS up to version 12.3.1 . By manipulating the Username argument, a remote, unauthenticated attacker can obtain partial access to user information (CVSS 3.1 score: 5.3 MEDIUM , low confidential...

PT-2026-95948

Name of the Vulnerable Software and Affected Versions code-projects Assessment Management version 1.0 Description Cross site scripting occurs in the User Editing component within the admin/edit-user.php file. A remote attacker can trigger this issue by manipulating the name, sname, email, usernam...

maigret v0.6.6

Maigret English · 简体中文 · Français 📖 Documentation Maigret collects a dossier on a person by username only , checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys required. AI profiling demo. Sponsors Noimosiny is a comprehensive...

CVE-2026-93532

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file...

EUVD-2026-83128

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file...

CVE-2026-93532 gedelumbung HospitalManagement Password Change password.php simpan improper authentication

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file...

CVE-2026-93532 gedelumbung HospitalManagement Password Change password.php simpan improper authentication

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file...

WordPress Yo plugin 1.1-1.3.1 - Unauthenticated SQL Injection via username Parameter vulnerability

Unauthenticated SQL Injection via username Parameter vulnerability discovered by João Ramos Maciel in WordPress Plugin Yo versions 1.1-1.3.1...

CVE-2026-15579

An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long input, triggering a buffer overflow that can cause the...

EUVD-2026-82861

An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long input, triggering a buffer overflow that can cause the...

CVE-2026-15579

An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long input, triggering a buffer overflow that can cause the...

CVE-2026-15579

An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long input, triggering a buffer overflow that can cause the...

CVE-2026-15579

Moxa Ethernet switches are affected by an out-of-bounds write vulnerability caused by improper validation of the username field length during Web login processing. A remote, unauthenticated attacker can submit a specially crafted overly long input , triggering a buffer overflow that crashes the a...

PT-2026-95339

Name of the Vulnerable Software and Affected Versions Ethernet switches affected versions not specified Description An out-of-bounds write issue occurs during Web login processing due to improper validation of the username field length. A remote attacker can submit a specially crafted, overly lon...

CVE-2026-92921

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

CVE-2026-92921

admin3 (versions through 3.0.0 ) stores account passwords using single-round MD5 with only the username as salt and no key derivation function, as seen in its SecurityUtil.java and UserCredential.java source files. Because MD5 is computationally inexpensive, an attacker with database access can r...