PT-2026-63366

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...

Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass

Device code phishing abuses a legitimate authentication feature designed for devices with limited input capabilities. This article breaks down how the technique works, examines a recent observed case, and outlines the layered security measures organizations can implement...

CVE-2026-63996

A flaw was found in the Linux kernel's ethtool CMIS Common Management Interface Specification module. A malicious SFP Small Form-Factor Pluggable module could provide a reply with a length longer than expected, leading to an out-of-bounds write. This vulnerability can result in memory corruption...

GHSA-GX3V-Q759-G323 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...

EUVD-2026-41613

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface...

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

CVE-2026-3183

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

EUVD-2026-46164

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

CVE-2026-3183 Multi Factor Auth Bypass

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

CVE-2026-3183 Multi Factor Auth Bypass

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

CVE-2026-3183

CVE-2026-3183 affects ManageEngine ADSelfService Plus versions before 6524. The vulnerability is described as a Multi Factor Authentication (MFA) bypass, enabling an attacker with network access and low privileges to bypass MFA (per CVSS 3.1 metrics: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N; base scor...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

Examining User Behavior and Cognitive Biases in Personal Password Security

Despite increasing awareness of cybersecurity risks, users continue to engage in insecure password practices, such as reusing passwords, choosing weak credentials, and neglecting security recommendations. The study explores the behavioral and cognitive factors that influence password...

PT-2026-61842

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

CVE-2026-42210

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

CVE-2026-42210 Webmin 2FA requirement bypass

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

EUVD-2026-46035

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

CVE-2026-42210

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...