CVE-2026-18356Low· 3.7▾ SunlitThe Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61438High· 7.3PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
GHSA-wf6j-7hvr-gr93High· 7.8Hydra legacy target blacklist permits unsafe PyYAML loading
CVE-2026-117530Medium· 6.7In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands
CVE-2026-116339High· 7.3iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist
CVE-2026-116140Low· 3.3ImageMagick: ImageMagick: Security policy bypass via flawed delegate invocation parsing (CVE-2026-116140)
CVE-2026-115845Medium· 6.4Incomplete validation in the run_script Python sandbox in AWS MCP Server