1541 matches found
Unbreakable Enterprise kernel security update
6.12.0-206.104.3.3 - inet: frags: strip GSO state from fragments before reassembly Xinyang Ge Orabug: 39974840 CVE-2026-80590 6.12.0-206.104.3.2 - KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Weiming Shi Orabug: 39931938 CVE-2026-74517 - tcp: challenge ACK for non-exact...
GHSA-7MGC-C7PQ-3RR3 Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the login.regenerate2FASecret task which requires only $user-exists, not $user-authorized can be called...
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the login.regenerate2FASecret task which requires only $user-exists, not $user-authorized can be called...
EUVD-2023-60613
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
akamai-vm-reverse
akamai-vm-reverse 反编译并清理过的 Akamai v3 VM，驱动最新的 sensordata 挑战脚本...
CVE-2023-54391
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
CVE-2023-54391 Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
CVE-2023-54391 Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
CVE-2023-54391
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains a critical authentication bypass in libpve-access-control before 8.0.4 . By supplying an arbitrary value in the tfa-challenge parameter of the access ticket API endpoint, unauthenticated attackers can skip password verification entirely an...
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
A flaw in the challenge handling for app-based multi-factor authentication allows the second factor to be bypassed. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled...
EUVD-2026-65118
Filament: Multi-factor authentication app can be bypassed when recovery codes are enabled...
GHSA-52XP-W8HR-XV3C Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
A flaw in the challenge handling for app-based multi-factor authentication allows the second factor to be bypassed. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled...
CVE-2026-84307
CVE-2026-84307 affects Filament (a Laravel full-stack component collection) in versions 4.0.0 through 4.12.5 and 5.7.5. In packages/panels/src/Auth/Pages/Login.php, the multi-factor authentication (MFA) challenge is presented before the canAccessPanel() check. For accounts that have MFA enabled b...
CVE-2026-84307 Filament: Password validity disclosure for accounts denied panel access on login page
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...
EUVD-2026-69556
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...
CVE-2026-84307 Filament: Password validity disclosure for accounts denied panel access on login page
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...
PT-2026-84401
Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.5 Filament versions prior to 5.7.5 Description The login page presents the multi-factor authentication MFA challenge before evaluating the canAccessPanel function. For accounts where canAccessPanel denies access...
CVE-2023-54391: Missing Critical Step in Authentication
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
PT-2026-84529
Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment VE versions 7.0 through 8.0 Description An authentication bypass exists in libpve-access-control that allows unauthenticated attackers to authenticate as any enabled user who does not have a second factor configured...
VulnCheck KEV: CVE-2023-54391
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...