CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

CVE-2026-110653

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress for WordPress is vulnerable to an unauthenticated authentication bypass in all versions up to and including 5.7.4 . The root cause is a race condition (TOCTOU) within the verifyOTP function due to a non-atomic read-m...

CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

EUVD-2026-103217

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

PT-2026-116200

Name of the Vulnerable Software and Affected Versions LatePoint versions prior to 5.7.5 Description An authentication bypass exists due to a race condition in the verifyOTP function. The issue stems from a non-atomic read-modify-write operation on the OTP verification attempts counter, where the...

BMC Helix Network Management Authentication Bypass

BMC Helix Network Management versions before 26.3.01 contain an authentication bypass when SAML-based single sign-on is configured, allowing the local administrator account to authenticate with any password...

Debian dsa-6569 : apache2 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6569 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6569-1 [email protected] https://www.debian.org/securit...

CVE-2026-111911: Improper Authentication

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, th...

NoMachine Redis Improper Authentication Local Privilege Escalation

NoMachine contains an improper authentication vulnerability in its Redis component that allows local attackers to escalate privileges and execute arbitrary code in the service account context...

CVE-2026-111898: Improper Authentication

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

CVE-2026-111884: Use of Single-factor Authentication

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111895: Improper Authentication

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111882: Improper Authentication

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

PT-2026-116469

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

PT-2026-116475

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.0 through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description An insecure direct object reference exists in the 'GET /admin/api/user/data/userId' endpoint. The system returns the complete faquserdata row f...

CVE-2026-110653: Improper Authentication

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

PT-2026-116481

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.0.0 through 4.1.8 Description An authentication bypass exists during the WebAuthn registration process. The registration endpoints allow credentials to be attached to any account without requiring a valid session or challen...

PT-2026-116466

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred username claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

PT-2026-116454

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.0-alpha through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description An authentication bypass exists that allows users authenticated via an Identity Provider IdP to skip Time-based One-Time Password TOTP...

GNU InetUtils 2.7 Telnetd Authentication Bypass

GNU InetUtils versions through 2.7 contain an authentication bypass in telnetd through the Telnet NEW-ENVIRON USER variable. The included proof of concept establishes an interactive session. https://packetstorm.news/download/236118...