Lucene search
+L

5392 matches found

Nuclei
Nuclei
added 2026/07/28 5:35 a.m.79 views

Really Simple Security < 9.1.2 - Authentication Bypass

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

9.8CVSS7AI score0.81722EPSS
SaveExploits21References7
Cvelist
Cvelist
added 2026/07/27 1:59 p.m.33 views

CVE-2026-59546 WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability

Subscriber Broken Authentication in Hide My WP Ghost = 7.0.06 versions...

7.4CVSS0.00361EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/27 1:59 p.m.19 views

CVE-2026-59546

CVE-2026-59546 concerns the WordPress plugin Hide My WP Ghost (versions

7.4CVSS5.8AI score0.00361EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/27 5:48 a.m.5 views

BIT-OPENBAO-2025-55003 OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao's Login Multi-Factor Authentication MFA system allows enforcing MFA using Time-based One Time Password TOTP. Due to...

5.7CVSS5.9AI score0.00199EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/23 7:54 p.m.39 views

CVE-2026-10697 MFA Bypass in MOVEit Transfer

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

7.5CVSS0.00292EPSS
SaveExploits0References1
The Hacker News
The Hacker News
added 2026/07/23 6:36 p.m.11 views

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor...

7.2CVSS7.3AI score0.21973EPSS
SaveExploits0
NVD
NVD
added 2026/07/23 4:17 p.m.8 views

CVE-2026-15616

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

9.1CVSS0.00328EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/23 3:43 p.m.8 views

EUVD-2026-48301

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

5.2AI score0.00328EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 3:43 p.m.14 views

CVE-2026-15616

Logto has a CVE-2026-15616 issue where the authentication flow does not enforce locally configured MFA during SSO. The root cause is that MFA can be bypassed when hasVerifiedSsoIdentity is true, enabling an attacker with a federated identity from a permissive upstream IdP to sign in via SSO and b...

9.1CVSS5.3AI score0.00328EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/23 3:43 p.m.28 views

CVE-2026-15616 Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

0.00328EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/23 3:43 p.m.7 views

CVE-2026-15616 Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

9.1CVSS5.3AI score
SaveExploits0References3
Patchstack
Patchstack
added 2026/07/23 9:38 a.m.6 views

WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Hide My WP Ghost versions = 7.0.06...

7.4CVSS5.8AI score0.00361EPSS
SaveExploits0Affected Software1
NVD
NVD
added 2026/07/23 7:16 a.m.7 views

CVE-2026-14291

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

7.5CVSS0.00327EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/23 6:0 a.m.8 views

CVE-2026-14291

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

5.4AI score0.00327EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 6:0 a.m.16 views

CVE-2026-14291

The CVE-2026-14291 entry concerns the security-ninja-premium WordPress plugin (before 5.290). The issue is that one of the two-factor authentication (2FA) code paths does not verify the second factor, enabling an unauthenticated attacker who knows a user’s password to complete authentication with...

7.5CVSS5.5AI score0.00327EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/23 6:0 a.m.8 views

EUVD-2026-47885

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

7.5CVSS5.4AI score0.00327EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/23 6:0 a.m.8 views

CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

5.4AI score0.00327EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/23 6:0 a.m.39 views

CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

0.00327EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/23 12:0 a.m.11 views

PT-2026-63574

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

5.5AI score0.00327EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/23 12:0 a.m.11 views

PT-2026-64020

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto fails to enforce locally configured Multi-Factor Authentication MFA during Single Sign-On SSO authentication. This flaw allows users to bypass second-factor requirements, potentially...

9.1CVSS5.9AI score0.00328EPSS
SaveExploits0References4
Rows per page
Query Builder