CVE-2026-82470 Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470 Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

Malicious Package

Overview 2fa-secretkey is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in 2fa-secretkey (npm)

Source: amazon-inspector 8458c66987512aafeb111d45ec4c5639bc5bb43cd342777b9972e727719fe2b7 The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdio-ignored child of the node runtime, so the payload runs automatically on npm install...

MAL-2026-15547 Malicious code in 2fa-secretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8458c66987512aafeb111d45ec4c5639bc5bb43cd342777b9972e727719fe2b7 The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdio-ignored child of the node...

Malicious code in 2fa-secretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8458c66987512aafeb111d45ec4c5639bc5bb43cd342777b9972e727719fe2b7 The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdio-ignored child of the node...

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Summary An unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the attacker's URL, and emails the link to the victim. When the victim...

GHSA-H854-C3M3-MH5V Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Summary An unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the attacker's URL, and emails the link to the victim. When the victim...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: selinux-policy (UTSA-2025-002272)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002272 advisory. An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently,...

CVE-2026-61790

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...

EUVD-2026-66714

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...

CVE-2026-61790 Weblate: Team-enforced 2FA is bypassed for global permissions

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...

CVE-2026-61790 Weblate: Team-enforced 2FA is bypassed for global permissions

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...

CVE-2026-61790 Weblate: Team-enforced 2FA is bypassed for global permissions

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...

CVE-2026-61790

Weblate is a web-based continuous localization platform. In versions prior to 2026.7 , a team can enforce a two-factor authentication (2FA) requirement for its members, but this requirement is not applied to site-wide global permissions — only to project-, component-, and workspace-scoped permiss...

NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions

Cybersecurity researchers have disclosed details of a new adversary-in-the-middle AitM phishing toolkit called NovaCookies that's used as a proxy to redirect Microsoft 365 sign-ins, while capturing authenticated sessions in the process. In a report shared with The Hacker News ahead of publication...

Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes

Cybersecurity researchers have disclosed details of a phishing-as-a-service PhaaS platform built to strip Apple's Activation Lock from stolen devices, using rented AI voice agents that call theft victims posing as Apple Support and ask for their device passcode. SOCRadar Threat Research Unit STRU...

CVE-2026-61790: Improper Access Control

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...

PT-2026-82298

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...

PT-2026-82292

This is a classic "roundup" post. Since the summary is generic "top threats you should know about" and the source is a vendor F5, I need to assume this is a curated list of multiple events. I will treat this as Scenario A Technical Threat but structure it as a digest of multiple items, pulling fr...