CVE-2026-100508 WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...

CVE-2026-100508

The WordPress Two Factor plugin versions

CVE-2026-11883 WebAuthn Provider for Two Factor < 2.5.6 - 2FA Bypass

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request...

CVE-2026-6816

An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2...