Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,612 results · page 11 of 73
Mar 5, 2026OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRFCVE-2026-28477 · Other software · OpenClaw · reported by VulnCheckMedium 5.9
OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled OAuth callback data, enabling credential substitution and token persistence for unauthorized accounts.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it hCVE-2026-3009 · Other software · Red Hat · reported by Red HatHigh 8.1
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 5, 2026Login with Salesforce: Does not validate that users are allowed to login through SalesforceCVE-2026-2418 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email
- Product
- Login with Salesforce
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Login with Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 4, 2026Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode.CVE-2025-70222 · Other software · Dlink · reported by MITRECritical 9.8
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode.
- Product
- Dir-513 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comdlink.com.cn
Mar 4, 2026Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin.CVE-2025-70221 · Other software · Dlink · reported by MITRECritical 9.8
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin.
- Product
- Dir-513 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comdlink.com.cn
Mar 3, 2026The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPCVE-2026-1492 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist. This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration.
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 2, 2026All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login: Authentication bypassCVE-2026-2628 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, including administrators.
- Product
- All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 2, 2026Cross Site Scripting vulnerability in Wethink Technology Inc 720yun pano-sdk 0.5.877 allows a remote attacker to execute arbitrary code via the LoginComp (ModulCVE-2025-66880 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Wethink Technology Inc 720yun pano-sdk 0.5.877 allows a remote attacker to execute arbitrary code via the LoginComp (Module 2093) and SignupComp (Module 2094) modules.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-27824 · Other software · kovidgoyal · reported by GitHubMedium 5.3
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and the `X-Forwarded-For` header. Since the `X-Forwarded-For` header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changing or adding this header, rendering the brute-force protection completely ineffective. This is particularly dangerous for calibre servers exposed to the internet, where brute-force protection is the primary defense against credential stuffing and password guessing attacks. Version 9.4.0 contains a fix for the issue.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-27810 · Other software · kovidgoyal · reported by GitHubMedium 6.4
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection vulnerability in the calibre Content Server allows any authenticated user to inject arbitrary HTTP headers into server responses via an unsanitized `content_disposition` query parameter in the `/get/` and `/data-files/get/` endpoints. All users running the calibre Content Server with authentication enabled are affected. The vulnerability is exploitable by any authenticated user and can also be triggered by tricking an authenticated victim into clicking a crafted link. Version 9.4.0 contains a fix for the issue.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injectiCVE-2019-25494 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields. Attackers can submit SQL operators like '=' 'or' in both credentials to manipulate the authentication query and gain unauthorized access to the admin panel.
- Product
- Homey BNB (Airbnb Clone Script)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoditsolutions.comexploit-db.com
Feb 27, 2026telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implCVE-2026-28372 · Other software · GNU · reported by MITREHigh 7.4
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.
- Product
- inetutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.hadrons.orglists.gnu.org
Feb 25, 2026User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2026-2356 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2 via the 'register_member' function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that newly registered on the site who has the 'urm_user_just_created' user meta set.
- Product
- User Registration & Membership – Custom Registration Form, Login Form, and User Profile
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 25, 2026A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login cCVE-2025-67601 · Other software · SUSE · reported by meissner@suse.deHigh 8.3
A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the –cacert flag results in the CLI attempting to fetch CA certificates stored in Rancher’s setting cacerts.
- Product
- rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Feb 24, 2026Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior do not implement rate limiting or account lockout on failed login attempts, enabCVE-2026-27521 · Other software · Binardat Ltd. · reported by VulnCheckMedium 6.9
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior do not implement rate limiting or account lockout on failed login attempts, enabling brute-force attacks against user credentials.
- Product
- 10G08-0800GSM Network Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinardat.comvulncheck.com
Feb 20, 2026Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameterCVE-2019-25432 · Other software · Part-DB · reported by VulnCheckHigh 8.8
Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to the application.
- Product
- Part-DB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 20, 2026An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login funCVE-2026-26722 · Other software · Keystorage · reported by MITRECritical 9.4
An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login functionality.
- Product
- Global Facilities Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Membee Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68844 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaleAB Membee Login membees-member-login-widget allows Reflected XSS.This issue affects Membee Login: from n/a through <= 2.3.6.
- Product
- Membee Login
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Membee Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-26065 · Other software · kovidgoyal · reported by GitHubCritical 9.3
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-26064 · Other software · kovidgoyal · reported by GitHubCritical 9.3
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in utils/zipfile.py does sanitize '..' via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode.CVE-2025-71244 · Other software · SPIP · reported by VulnCheckMedium 5.1
SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary external site after login. This vulnerability only affects sites where the login page has been overridden to function in AJAX mode. It is not mitigated by the SPIP security screen.
- Product
- SPIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.spip.netgit.spip.net
Feb 18, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Reflected Cross-Site ScriptingCVE-2026-1404 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the filter parameters (e.g., 'filter_first_name') in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.11.1
- What to do
- Affects up to 2.11.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins.CVE-2026-1435 · Other software · Graylog · reported by cve-coordination@incibe.esCritical 9.3
Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not invalidate previously issued session identifiers, which remain valid even after multiple consecutive logins by the same user. As a result, a stolen or leaked 'sessionId' can continue to be used to authenticate valid requests. Exploiting this vulnerability would allow an attacker with access to the web service/API network (port 9000 or HTTP/S endpoint of the server) to reuse an old session token to gain unauthorized access to the application, interact with the API/web, and compromise the integrity of the affected account.
- Product
- Graylog Web Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Payment bypassCVE-2025-14444 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and including, 6.0.6.9. This is due to the plugin trusting client-supplied values for payment verification without validating that the payment actually went through PayPal. This makes it possible for unauthenticated attackers to bypass paid registration by manipulating payment status and activating their account without completing a real PayPal payment.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 6.0.6.9
- What to do
- Affects up to 6.0.6.9. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 16, 2026Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated useCVE-2026-0999 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.4
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2026Magic Login Mail or QR Code: Privilege EscalationCVE-2026-2144 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. The file is only deleted after wp_mail() completes, creating an exploitable race condition window. This makes it possible for unauthenticated attackers to trigger a login link request for any user, including administrators, and then exploit the race condition between QR code file creation and deletion to obtain the login URL encoded in the QR code, thereby gaining unauthorized access to the targeted user's account.
- Product
- Magic Login Mail or QR Code
- Affected
- up to 2.05
- What to do
- Affects up to 2.05. Update Magic Login Mail or QR Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2026PRO-7070 Hazır Profesyonel Web Sitesi version 1.0 contains an authentication bypass vulnerability in the administration panel login page.CVE-2019-25335 · Other software · Websitem · reported by VulnCheckHigh 8.8
PRO-7070 Hazır Profesyonel Web Sitesi version 1.0 contains an authentication bypass vulnerability in the administration panel login page. Attackers can bypass authentication by using '=' 'or' as both username and password to gain unauthorized access to the administrative interface.
- Product
- 7070 Hazır Profesyonel Web Sitesi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Feb 12, 2026Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass authentication by mCVE-2019-25325 · Other software · Thrive · reported by VulnCheckHigh 8.8
Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass authentication by manipulating the 'user' POST parameter. Attackers can inject malicious SQL code like ' or 1=1# to manipulate login queries and gain unauthorized access to the application.
- Product
- Smart Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexchange.xforce.ibmcloud.com
Feb 12, 2026Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentials.CVE-2019-25322 · Other software · Heatmiser · reported by VulnCheckCritical 9.3
Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentials. Attackers can access the device by using the hard-coded username 'admin' and password 'admin' in the hidden form input fields.
- Product
- Heatmiser Netmonitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Feb 11, 2026BloodX 1.0 contains an authentication bypass vulnerability in login.php that allows attackers to access the dashboard without valid credentials.CVE-2020-37156 · Other software · diveshlunker · reported by VulnCheckMedium 6.9
BloodX 1.0 contains an authentication bypass vulnerability in login.php that allows attackers to access the dashboard without valid credentials. Attackers can exploit the vulnerability by sending a crafted payload with '=''or' parameters to bypass login authentication and gain unauthorized access.
- Product
- BloodX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 7, 2026JAY Login & Register: Privilege EscalationCVE-2025-15100 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_panel_ajax_update_profile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
- Product
- JAY Login & Register
- Affected
- up to 2.6.03
- What to do
- Affects up to 2.6.03. Update JAY Login & Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 7, 2026JAY Login & Register: Privilege EscalationCVE-2025-15027 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_login_register_ajax_create_final_user' function. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
- Product
- JAY Login & Register
- Affected
- up to 2.6.03
- What to do
- Affects up to 2.6.03. Update JAY Login & Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 4, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects MicCVE-2026-0948 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26.CVE-2025-10878 · Other software · Insaat · reported by MITRECritical 10
A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are vulnerable to SQL injection, allowing unauthenticated attackers to bypass authentication completely. Successful exploitation grants full administrative access to the application, including the ability to manipulate the public-facing website content (HTML/DOM manipulation).
- Product
- Fikir Odalari AdminPando
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comonurcangenc.com.tr
Feb 3, 2026GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins.CVE-2020-37116 · Websites & servers · reported by VulnCheckHigh 8.7
GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to obtain the MySQL password, leading to full database compromise.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.openeclass.orgexploit-db.com
Feb 3, 2026Reflected XSS in Apache Syncope's Enduser Login page.CVE-2026-23794 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.8
Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials. This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3. Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.
- Product
- Apache Syncope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Feb 2, 2026An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP-Link Archer BE230 v1.2, BE3600v1, AX10 v3 and AXE75 v1, allowing an CVE-2026-0631 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 8.5
An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP-Link Archer BE230 v1.2, BE3600v1, AX10 v3 and AXE75 v1, allowing an adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420 and Archer AXE75 v1 < 1.5.6 Build 20260623.
- Product
- Archer BE230 v1.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Feb 2, 2026The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 CVE-2026-25202 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comCritical 9.8
The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than 21.1090.1.
- Product
- MagicINFO 9 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungtv.com
Feb 1, 2026Knap Advanced PHP Login 3.1.3 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious script code in the name CVE-2022-50940 · Other software · ajay138 · reported by VulnCheckMedium 5.1
Knap Advanced PHP Login 3.1.3 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious script code in the name parameter. Attackers can exploit the vulnerability to execute arbitrary scripts in users and activity log backend modules, potentially leading to session hijacking and persistent phishing attacks.
- Product
- Knap Advanced PHP Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaravel-vuejs.comvulncheck.com
Jan 30, 2026Infor Storefront B2B 1.0 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'usr_name' parameter in login rCVE-2020-37033 · Other software · Insite Software · reported by VulnCheckHigh 8.8
Infor Storefront B2B 1.0 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'usr_name' parameter in login requests. Attackers can exploit the vulnerability by injecting malicious SQL code into the 'usr_name' parameter to potentially extract or modify database information.
- Product
- Infor Storefront B2B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Jan 29, 2026Elaniin CMS 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard by manipulating the login page with SQL injection.CVE-2020-36999 · Other software · Elaniin · reported by VulnCheckHigh 8.8
Elaniin CMS 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard by manipulating the login page with SQL injection. Attackers can bypass authentication by sending crafted email and password parameters with '=''or' payload to login.php, granting unauthorized access to the system.
- Product
- Elaniin CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026Custom Login Page Customizer: Does not have a proper password reset processCVE-2025-14975 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
- Product
- Custom Login Page Customizer
- Fixed in
- 2.5.4
- What to do
- Update Custom Login Page Customizer to 2.5.4 or newer.
Jan 28, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable LoginCVE-2025-13986 · Websites & servers · reported by mlhess@drupal.orgMedium 4.2
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: frCVE-2025-13982 · Websites & servers · reported by mlhess@drupal.orgHigh 8.1
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: from 0.0.0 before 1.0.3.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulatiCVE-2020-36945 · Other software · WEBDAMN.COM · reported by VulnCheckHigh 8.8
WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating email credentials. Attackers can inject the payload '<email>' OR '1'='1' in both username and password fields to gain unauthorized access to the user panel.
- Product
- WebDamn User Registration & Login System with User Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwebdamn.comwebdamn.com
Jan 28, 2026User Activity Log: Does not properly handle failed login attempts in some casesCVE-2025-13471 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)
- Product
- User Activity Log
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2026VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens.CVE-2020-36948 · Other software · VestaCP · reported by VulnCheckHigh 8.7
VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.
- Product
- VestaCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvestacp.comexploit-db.com
Jan 27, 2026SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service.CVE-2020-36946 · Other software · Flexense Ltd. · reported by VulnCheckHigh 8.7
SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an oversized payload in the login request to overwhelm the application and potentially disrupt service availability.
- Product
- SyncBreeze
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsyncbreeze.comexploit-db.com
Jan 24, 2026Login Page Editor: Cross-Site Request ForgeryCVE-2026-1088 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Login Page Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce validation on the devotion_loginform_process() AJAX action. This makes it possible for unauthenticated attackers to update the plugin's login page settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Login Page Editor
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Login Page Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026Admin login URL Change: Missing AuthorizationCVE-2026-24578 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jahid Hasan Admin login URL Change admin-login-url-change allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin login URL Change: from n/a through <= 1.1.5.
- Product
- Admin login URL Change
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Admin login URL Change to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.