CVE-2026-63238

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

CVE-2026-13690

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...

CVE-2026-63238 Authentication bypass vulnerability

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

CVE-2026-63238 Authentication bypass vulnerability

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

EUVD-2026-50133

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

CVE-2026-63238

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

CVE-2026-63238

CVE-2026-63238 describes an authentication bypass in Koollab LMS where an unauthenticated attacker can take over any account (including administrator) by supplying a valid user UUID to the 2FA validation endpoint. The connected records reiterate this access path but do not provide version, patch,...

CVE-2026-63237

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts...

CVE-2026-63237

CVE-2026-63237 describes a TOTP-based two-factor authentication bypass in Koollab LMS. The vulnerability arises from allowing a client-controlled seed to generate a valid one-time password, enabling bypass of the second authentication factor and potentially unauthorized admin access. Affected pro...

EUVD-2026-50132

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts...

CVE-2026-13690

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...

CVE-2026-11974

The wp-media-folder-addon WordPress plugin versions before 4.1.7 is vulnerable to Arbitrary File Disclosure and Server-Side Request Forgery (SSRF) . The root cause is the failure to validate a user-supplied parameter used in a file read operation within two AJAX actions accessible to unauthentica...

CVE-2026-13690

The UsersWP WordPress plugin (versions before 1.2.67 ) contains a two-factor authentication bypass vulnerability. The flaw exists because the plugin fails to validate the selected authentication provider within its two-factor login handler. This allows an attacker who possesses a user's primary c...

CVE-2026-13690 UsersWP < 1.2.67 - Two-Factor Authentication Bypass

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...

EUVD-2026-50117

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...

CVE-2026-11974

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

CVE-2026-13690 UsersWP < 1.2.67 - Two-Factor Authentication Bypass

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...

CVE-2026-12144

creationtimestamp| type| source ---|---|--- 2026-07-29 03:06:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqwzlx4dh2a 2026-07-29 03:10:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqxacujlm2g 2026-07-29 07:00:17+00:00| seen|...

CVE-2026-65094

creationtimestamp| type| source ---|---|--- 2026-07-29 02:15:51+00:00| seen| https://bsky.app/profile/potato.software/post/3mrqu6gweue2n 2026-07-29 02:15:51+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrqu6fq7xr2v 2026-07-29 16:05:35+00:00| seen|...

PT-2026-65736

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 Description Apache Traffic Server drops the per-stream buffer cap during the dechunking...