CVE-2026-107268

The Two Factor Authentication - TFA / Passwordless Login module for Drupal (versions 0.0.0 to 5.4.1 and 5.5.0 to 5.5.2) is vulnerable to an information disclosure flaw via its headless login endpoint. The root cause is an insertion of sensitive information into sent data where the module returns ...

EUVD-2026-113568

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2...

EulerOS 2.0 SP11 : kbd (EulerOS-SA-2026-4331)

According to the versions of the kbd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented...

EulerOS 2.0 SP11 : kbd (EulerOS-SA-2026-4240)

According to the versions of the kbd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented...

DRUPAL-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

PT-2026-107759

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

AlmaLinux 9.2 [TuxCare] Security Update: kbd / kbd-legacy / kbd-misc (ALMALINUX9.2:CLSA-2026:1788600455)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788600455 advisory. - openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the...

PT-2026-120353

Уязвимость программного обеспечения TrueConf Server связана с недостатками процедуры аутентификации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, войти под произвольной учётной записью без пароля...

CVE-2026-79576

The Digital-Infrastructure v9.6.7 software contains an improper authentication vulnerability within its Single-Sign On (SSO) component. This flaw allows an attacker to authenticate as any user, including the Admin , without providing a password. While a proof of concept (PoC) is indicated in the ...

PT-2026-87114

An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...

TencentOS Server 4: kbd (TSSA-2026:0868)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0868 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Important: kbd

Issue Overview: openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the...

Amazon Linux 2023 : kbd, kbd-legacy, kbd-misc (ALAS2023-2026-2109)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2109 advisory. openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateus...

Important: kbd

Issue Overview: openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the...

Amazon Linux 2 : kbd, --advisory ALAS2-2026-3885 (ALAS-2026-3885)

The version of kbd installed on the remote host is prior to 1.15.5-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3885 advisory. openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the...

OESA-2026-3505 kbd security update

The project contains tools for managing Linux console ,including Linux console,virtual terminals, keyboard, etc, mainly, what they do is loading console fonts and keyboard maps. Security Fixes: openvt -u is intended to identify the owner of the current VT and then execute login as that user from ...

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

CVE-2026-59808

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

EUVD-2026-64266

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...