critical · CVSS v3 9.8

CVE-2026-118201

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every …

Description

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.8
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-119506

Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.

View analysis

critical

CVE-2026-124560

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

critical

CVE-2026-113363

NEC WebSAM WinShare versions 7.2.0-7.5.0, 7.6.0, and 7.7.0-7.7.2 on Windows contain an input validation flaw that allows a remote unauthenticated attacker to send a crafted packet and execute arbitrary commands with SYSTEM privileges. The vulnerability can compromise the entire host and expose sensitive data. It affects organizations using these WinShare versions.

View analysis

critical

CVE-2026-113364

NEC WebSAM WinShare on Windows has a critical buffer overflow that allows a remote unauthenticated attacker to execute code with SYSTEM privileges. The flaw exists in versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2. It can be triggered by sending a crafted packet with a malformed data size value in the protocol header.

View analysis