CVE-2026-84307 Filament: Password validity disclosure for accounts denied panel access on login page

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...

CVE-2026-84307

CVE-2026-84307 affects Filament (a Laravel full-stack component collection) in versions 4.0.0 through 4.12.5 and 5.7.5. In packages/panels/src/Auth/Pages/Login.php, the multi-factor authentication (MFA) challenge is presented before the canAccessPanel() check. For accounts that have MFA enabled b...

PT-2026-84529

Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment VE versions 7.0 through 8.0 Description An authentication bypass exists in libpve-access-control that allows unauthenticated attackers to authenticate as any enabled user who does not have a second factor configured...

PT-2026-84401

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.5 Filament versions prior to 5.7.5 Description The login page presents the multi-factor authentication MFA challenge before evaluating the canAccessPanel function. For accounts where canAccessPanel denies access...

VulnCheck KEV: CVE-2023-54391

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2026-16599

A flaw was found in wget's FTP OPIE/S-KEY authentication functionality. A malicious FTP server or a network attacker can send a specially crafted OPIE challenge. This challenge contains a sequence number that, when processed by wget, can lead to an excessive number of cryptographic computations...

CVE-2026-16599 Denial of Service in GNU wget

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network...

CVE-2026-77567

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-77567

CVE-2026-77567 affects Filament , a full-stack component library for Laravel development. Prior to versions 4.12.0 and 5.7.0 , incorrect challenge-form required-field handling allows app-based multi-factor authentication (MFA) to be bypassed when recovery codes are enabled. Email-based MFA is not...

CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-74649

A flaw was found in the Linux kernel's rtl8723bs driver. A remote attacker, by operating a malicious Access Point AP, could send a specially crafted Wi-Fi Protected Equivalent Privacy WEP shared-key authentication challenge. This could lead to an out-of-bounds write or information disclosure due ...

PT-2026-81029

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.0 Filament versions prior to 5.7.0 Description Incorrect handling of required fields in the challenge form allows the bypass of app-based multi-factor authentication when recovery codes are enabled. Email-based...

CVE-2026-74649

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

UBUNTU-CVE-2026-74649

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74649

A missing length validation in the Linux kernel rtl8723bs staging driver's WEP shared-key authentication handler (OnAuthClient()) allows a malicious Access Point to send a malformed WLAN_EID_CHALLENGE element with a length up to 255 bytes, which is then copied via memcpy() into a fixed 128-byte c...

CVE-2026-74649 staging: rtl8723bs: fix missing shared-key auth challenge length check

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

PT-2026-79654

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg txt...

CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

CVE-2026-62669 Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...