Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the data export process. An attacker can obtain TOTP shared secrets in plaintext by accessing exported user data ZIP archives,...

Information Exposure

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the data export process. An attacker can obtain TOTP shared secrets in plaintext by accessing exported user data ZIP archives,...

EUVD-2026-71013

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...

BIT-JOOMLA-2026-73337 Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2026-85590: Use of Single-factor Authentication

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...

CVE-2026-85588: Exposure of Sensitive Information to an Unauthorized Actor

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

CVE-2026-85237

A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...

EUVD-2026-62540

Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge...

CVE-2026-84479

WWBN AVideo (version e01e41ecc and earlier) contains an authentication bypass vulnerability where three login-time security controls rely solely on the client-supplied User-Agent header. The isAVideoEncoder() and isAVideoMobileApp() checks match HTTP_USER_AGENT against hardcoded literals ("AVideo...

CVE-2026-84479: Authentication Bypass by Spoofing

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

CVE-2026-82228

SiteGround Security WordPress plugin versions ≤ 1.6.6 are affected by an unauthenticated 2FA Bypass vulnerability, discovered by Ananda Dhakal via Patchstack. The flaw allows a network-based attacker (with high attack complexity, no prior privileges or user interaction) to bypass two-factor authe...

Linux Distros Unpatched Vulnerability : CVE-2026-82470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp...

SUSE CVE-2026-61790

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...

BIT-KEYCLOAK-2025-3910 Org.keycloak.authentication: two factor authentication bypass

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

Insufficiently Protected Credentials

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the offsetGet process. An attacker can retrieve sensitive user information, such as hashed passwords...

CVE-2026-59799

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...

CVE-2026-59799 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...

EUVD-2026-63841

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...

CVE-2026-59799: Improper Privilege Management

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...

PT-2026-79322

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper Privilege Management in the Two-factor authentication plugin allows for the bypass of the two-factor authentication...