60105 matches found
CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...
CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...
CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...
CVE-2026-49870
In Snipe-IT before v8.6.0, the POST /two-factor endpoint lacked rate limiting, lockout, or attempt counters, allowing an attacker with valid credentials to brute-force TOTP codes (3 of 1,000,000 accepted due to window=1). A successful guess grants a full authenticated session. In optional 2FA mod...
CVE-2026-61281
creationtimestamp| type| source ---|---|--- 2026-08-19 17:52:41+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-29 19:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mual57vgze23...
CVE-2026-70904
creationtimestamp| type| source ---|---|--- 2026-08-19 17:52:24+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-29 14:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mua2erwkux2x...
CVE-2026-61302
creationtimestamp| type| source ---|---|--- 2026-08-19 17:52:10+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-29 04:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu6ytvvxke2y...
CVE-2026-70914
creationtimestamp| type| source ---|---|--- 2026-08-19 17:51:44+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-70957
creationtimestamp| type| source ---|---|--- 2026-08-19 17:49:55+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-29 11:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu7rykeyo52y...
CVE-2026-70736
creationtimestamp| type| source ---|---|--- 2026-08-19 17:48:23+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-70973
creationtimestamp| type| source ---|---|--- 2026-08-19 17:47:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-71056
creationtimestamp| type| source ---|---|--- 2026-08-19 17:47:06+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-62481
creationtimestamp| type| source ---|---|--- 2026-08-19 17:47:00+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-61276
creationtimestamp| type| source ---|---|--- 2026-08-19 17:46:46+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-30 22:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mudfnzoxnf22...
EUVD-2026-62598
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
CVE-2026-66794 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
CVE-2026-66794
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering
A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input...