1295 matches found
-CVE-2022-22954-scanner
CVE-2022-22954-scanner 脆弱性の概要 VMware Workspace ONE Access（以前はVMware Identity Managerと呼ばれていました）は、多要素認証、条件付きアクセス、シングルサインオンを通じて、従業員がSaaS、Web、ネイティブモバイルアプリケーションに迅速にアクセスできるようにすることを目的としています。 影響を受けるバージョン： VMware Workspace ONE Access Appliance （バージョン：20.10.0.0 、20.10.0.1 、21.08.0.0 、21.08.0.1 ） VMware...
CVE-2026-84831
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor...
EUVD-2026-70363
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor...
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code...
Filament: Password validity disclosure for accounts denied panel access on login page
When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating canAccessPanel. For an account that canAccessPanel denies, submitting the correct password renders the challenge while an incorrect password returns the generic failure message,...
CVE-2026-84307
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...
EUVD-2026-69556
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...
CVE-2026-73337
Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-73337
Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...
Ghost: Blind Password Hash Disclosure in Ghost Admin API
Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...
CVE-2026-67611
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...
CVE-2026-67611 OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...
CVE-2026-67611 OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...
6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization...
CVE-2026-16971
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
CVE-2026-16971 DFIR-IRIS Missing Brute Force Protection in OTP Validation
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
CVE-2026-16971
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
EUVD-2026-51072
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
PT-2026-66447
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains
Phishing was the primary means of gaining initial access this quarter, appearing in over half of all Cisco Talos Incident Response Talos IR engagements - an increase from approximately a third of engagements last quarter. Attackers continued to innovate their delivery methods to evade defenses,...