CVE-2026-62671

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer...

WordPress Google Authenticator plugin < 0.56 - 2FA Secret Overwrite via CSRF vulnerability

2FA Secret Overwrite via CSRF vulnerability discovered by Miguel Mendez Z in WordPress Plugin Google Authenticator versions 0.56...