PT-2026-99349

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.5 Description Insufficient enforcement of account-level attempt limits during MFA login challenges allows attackers with a valid password to guess TOTP Time-based One-Time Password codes. Because rate limiting ...

CVE-2026-49470

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

CVE-2026-49470

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

UBUNTU-CVE-2026-49470

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

EUVD-2026-87282

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

CVE-2026-49470 GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

CVE-2026-49470

The asset management software GLPI versions 11.0.0 through 11.0.7 contains a vulnerability where the time-based one-time password (TOTP) verification endpoint lacks a limit on failed submissions per user. An attacker possessing a user's primary credentials can perform a brute-force attack against...

CVE-2026-49470 GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

CVE-2026-49470 GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

CVE-2026-49470: Improper Restriction of Excessive Authentication Attempts

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

PT-2026-99068

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description The time-based one-time password TOTP verification endpoint does not limit failed submissions per user. An attacker with a user's primary authentication credentials can repeatedly submit TOTP...

Improper Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Authentication via the check endpoint, which allows authentication based solely on a valid 6-digit TOTP token and a user-chosen user-id, withou...

Improper Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Authentication via the check endpoint, which allows authentication based solely on a valid 6-digit TOTP token and a user-chosen user-id, withou...

CVE-2026-79763

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

CVE-2026-56737

phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without firs...

CVE-2026-79763 Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

CVE-2026-79763 Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

CVE-2026-79763

The web-based server management platform Termix (versions 2.4.0 through 2.5.1) is vulnerable to a regression that allows MFA-critical operations to be performed using only an account password. Specifically, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints in src/backend/da...

CVE-2026-79763 Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

EUVD-2026-86120

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...