6236 matches found
WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability
Denial of Service Attack vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Two Factor versions = 0.16.0...
Hiding in Plain Sight: Decoupling Pretext from Actuation for Skill Poisoning in LLM Agents
LLM agents increasingly rely on reusable Skills for complex, multi-step tasks, creating a critical supply-chain attack surface where poisoned Skill content steers agent decision loops under benign requests. Existing skill poisoning attacks either colocate actuation with its contextual pretext or...
CVE-2026-100508: Allocation of Resources Without Limits or Throttling
Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...
PT-2026-103137
Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...
Quarterly WordPress Threat Intelligence Report – Q2 2026
As the leader in WordPress security, Wordfence provides unparalleled security coverage that fully encompasses protection, active monitoring, detection, and response all built around our threat intelligence, demonstrating a strong commitment to security. Our mission is to ensure comprehensive...
Linux Distros Unpatched Vulnerability : CVE-2026-53628
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth,...
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens panel2fatokens without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated...
CVE-2026-100712
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...
CVE-2026-100667
grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...
CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...
CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...
EUVD-2026-87685
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...
CVE-2026-100712
The froxlor software (versions through 2.3.10 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack that disables a user's two-factor authentication (2FA) . The root cause is that the 2FA management page (e.g., /customer_index.php?page=2fa&action=delete) responds to unauthenticated-trigge...
CVE-2026-100709
Froxlor versions through 2.3.10 are vulnerable to a second-factor bypass due to a namespace confusion in remembered-2FA tokens (panel_2fa_tokens ). The system stores only a numeric user ID without recording the account namespace, and the lookup is not constrained to specific account types. Conseq...
CVE-2026-100667 grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass
grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...
CVE-2026-100667 grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass
grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...
EUVD-2026-87761
grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...
CVE-2026-100667
The grav-plugin-login (Grav CMS Login plugin) versions >= 3.8.7 and
CVE-2026-100709: Improper Authentication
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens panel2fatokens without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated...
CVE-2026-100667: Missing Critical Step in Authentication
grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...