CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

EUVD-2026-103324

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111895

The phpMyFAQ application (versions 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta ) contains an authentication bypass in the Microsoft Entra ID login flow. The root cause is located in the AuthEntraId::create() function, which improperly links users using the mutable preferred_username claim and ...

CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111882 phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

CVE-2026-111882

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

EUVD-2026-103336

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

CVE-2026-111882

The phpMyFAQ application versions 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta are vulnerable to an authentication bypass (CWE-287). The root cause lies in the Keycloak and Entra ID SSO callbacks, which allow IdP-authenticated users to skip TOTP two-factor authentication . An attack...

CVE-2026-111882 phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

CVE-2025-52691-PoC-SmarterMail-authentication-bypass-exploit-WT-2026-0001

CVE-2025-52691 / WT-2026-0001 SmarterMail Exploit 🚨 IMPORTANT NOTICE This tool is for authorized security testing and educational purposes only! Unauthorized use is illegal and unethical Only use on systems with explicit authorization Use at your own risk Users are responsible for compliance with...

Exploit for CVE-2026-111823

CVE-2026-111823 — Mage AI OAuth authentication bypass !PoCb...

CVE-2026-39987

CVE-2026-39987 - marimo Terminal WebSocket Authentication Bypass poc Overview This repository contains CVE-2026-39987 affecting marimo versions before 0.23.0. The vulnerability exists in the terminal WebSocket endpoint, where insufficient authentication enforcement may allow an unauthenticated...

MGASA-2026-0515 Updated curl package fixes security vulnerabilities

curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set...

CVE-2026-110653

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

EUVD-2026-103217

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

CVE-2026-110653

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress for WordPress is vulnerable to an unauthenticated authentication bypass in all versions up to and including 5.7.4 . The root cause is a race condition (TOCTOU) within the verifyOTP function due to a non-atomic read-m...