EUVD-2026-104581

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...

IBM Verify Identity Access Trust Management Vulnerability

The IBM Verify Identity Access version 11.0.3.1 and the IBM Security Verify Access Appliance version 10.0.9.3 have vulnerabilities related to trust management. These vulnerabilities stem from the use of hardcoded credentials, which may allow attackers located physically nearby to obtain elevated...

PT-2026-117626

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...

CVE-2026-112775: Improper Authentication

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...

PT-2026-117701

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials...

Craft CMS authorization issue vulnerability

Craft CMS versions 5.0.0 to 5.11.0 have a vulnerability related to authorization. This vulnerability arises from the fact that the users/verify-email function does not invalidate verification codes for active users. Attackers can reuse these verification codes to bypass authentication. After the...

CVE-2026-110024 @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

CVE-2026-110024 @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

CVE-2026-110024

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

PT-2026-116648

Name of the Vulnerable Software and Affected Versions @fastify/jwt versions prior to 10.2.5 Description In the top-level sign and verify methods, per-call options replace globally configured defaults instead of merging with them. This behavior causes any global default not explicitly restated in...

CVE-2026-110024: Insufficient Session Expiration

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

Fastify @fastify/jwt session mechanism vulnerability

The Fastify @fastify/jwt versions prior to 10.2.5 have a session mechanism vulnerability. This vulnerability arises from the use of the top-level sign and verify methods, which replace rather than merge the global default configurations. As a result, global default protections such as token...

CVE-2026-111675

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

CVE-2026-111675

The Course-tencent-cloud application (through version 2.0.1 ) is vulnerable to an improper restriction of authentication attempts (CWE-307). The vulnerability allows unauthenticated attackers to brute force 6-digit SMS or email verification codes because these codes are never invalidated or limit...

CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

EUVD-2026-102966

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

EUVD-2026-102481

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...