307352 matches found
EUVD-2026-91934
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...
CVE-2026-103514
The WP 2FA WordPress plugin, in versions prior to 4.1.0 , is vulnerable to a two-factor authentication bypass. The root cause is the failure to invalidate a time-based one-time passcode (TOTP) after its initial use. An attacker who possesses an account's password and observes a valid code within ...
CVE-2026-95328
A confused deputy flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553148673...
CVE-2026-95300
A missing authorization flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/545449081...
CVE-2026-95374
An incorrect authorization flaw was found in the Network component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/543464436...
CVE-2026-95295
An information leak flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517596255...
CVE-2026-95346
An ui misrepresentation flaw was found in the Chromoting component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514059630...
Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to 1 CFIDE/administrator/settings/mappings.cfm, 2 logging/settings.cfm, 3 datasources/index.cfm, 4...
Fedora 43 : cockpit-machines (2026-4923296720)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4923296720 advisory. Automatic update for cockpit-machines-357-1.fc43. Changelog for cockpit-machines Wed Sep 23 2026 Packit - 357-1 - Harden against local attacks from...
Fedora 44 : cockpit-machines (2026-57e39fc2fa)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-57e39fc2fa advisory. Automatic update for cockpit-machines-357-1.fc44. Changelog for cockpit-machines Wed Sep 23 2026 Packit - 357-1 - Harden against local attacks from...
PT-2026-104520
Name of the Vulnerable Software and Affected Versions WP 2FA WordPress plugin versions prior to 4.1.0 Description The plugin fails to invalidate a time-based one-time passcode after its initial use. This allows an attacker who possesses a user's password and has intercepted a valid code during it...
Linux Distros Unpatched Vulnerability : CVE-2026-103627
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium...
CVE-2026-103514: Improper Authentication
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...
Bounded Reasoning: Cognitive Hierarchy in Human-Versus-AI Cyber Defense
Human-agent evaluations often compress interaction into a single performance score, even when human and automated policies adapt differently over time. We study this in a sequential cyber-defense game on an attack graph, where a human or reinforcement-learning defender protects cloud assets again...
CVE-2026-104982: Improper Limitation of a Pathname to a Restricted Directory
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setupdocumentcontentlist/gstrdupprintf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely...
EUVD-2026-57757
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header...
Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks
Summary Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in some cases. Details https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.goL333-L347 If r.Config.ServerName is empty, DNSName will be empty...
GHSA-5WF9-H793-W73C Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks
Summary Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in some cases. Details https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.goL333-L347 If r.Config.ServerName is empty, DNSName will be empty...
CVE-2026-82042 UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNALKEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint...
CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...