CVE-2026-77771

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

PT-2026-89292

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

PT-2026-89406

🚨 CVE-2026-88895 CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or creat...

CVE-2026-86723

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge that uses loose comparison == instead of strict comparison === against unset session values. Attackers with only a password can submit an empty request to...

CVE-2026-86723 AVideo LoginControl PGP Authentication Bypass via verifyChallenge

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge that uses loose comparison == instead of strict comparison === against unset session values. Attackers with only a password can submit an empty request to...

EUVD-2026-72859

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge that uses loose comparison == instead of strict comparison === against unset session values. Attackers with only a password can submit an empty request to...

EUVD-2026-72858

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

CVE-2026-86722 AVideo Authentication Bypass via SQL Cache Invalidation

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

CVE-2026-86722

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by an authentication bypass rooted in its SQL data layer: sqlDAL caches empty result sets that writeSql never invalidates. As a result, when a user attempts two-factor authentication on a new device, the confirmation code ...

CVE-2026-86722 AVideo Authentication Bypass via SQL Cache Invalidation

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

CVE-2026-86722 AVideo Authentication Bypass via SQL Cache Invalidation

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

CVE-2026-86722: Improper Authentication

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

PT-2026-87119

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

PT-2026-87120

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge that uses loose comparison == instead of strict comparison === against unset session values. Attackers with only a password can submit an empty request to...

CVE-2026-86723: Improper Authentication

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge that uses loose comparison == instead of strict comparison === against unset session values. Attackers with only a password can submit an empty request to...

Aegis v3.4.3

Aegis Authenticator Aegis Authenticator is a free, secure and open source 2FA app for Android. It aims to provide a secure authenticator for your online services, while also including some features missing in existing authenticator apps, like proper encryption and backups. Aegis supports HOTP and...

CVE-2026-86117

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...

CVE-2026-86117

Coolify (through version 4.3.17 ) is affected by an authentication bypass in its OAuth callback handler. The root cause is that the handler signs users into existing accounts based solely on email address matching , without verifying provider assertions or binding OAuth identities. An attacker ca...

PT-2026-86388

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the data export process. An attacker can obtain TOTP shared secrets in plaintext by accessing exported user data ZIP archives,...