CVE-2026-17593 Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration

An account holding the nexus:settings:update permission in Nexus Repository 3 or the equivalent nexus:settings permission in the legacy Nexus Repository 2 could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of...

CVE-2026-17593 Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration

An account holding the nexus:settings:update permission in Nexus Repository 3 or the equivalent nexus:settings permission in the legacy Nexus Repository 2 could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of...

CVE-2026-17593

An account holding the nexus:settings:update permission in Nexus Repository 3 or the equivalent nexus:settings permission in the legacy Nexus Repository 2 could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of...

CVE-2026-17593 Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration

An account holding the nexus:settings:update permission in Nexus Repository 3 or the equivalent nexus:settings permission in the legacy Nexus Repository 2 could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of...

CVE-2026-17593

Nexus Repository 3 (and legacy Nexus Repository 2) is affected by CVE-2026-17593 where an account with nexus:settings:update can submit arbitrary realm identifiers via an internal configuration API that doesn’t validate against registered realms. Unrecognized entries are persisted and reread via ...

CVE-2026-17593: Use of Externally-Controlled Input to Select Classes or Code

An account holding the nexus:settings:update permission in Nexus Repository 3 or the equivalent nexus:settings permission in the legacy Nexus Repository 2 could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of...

EUVD-2026-54224

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

CVE-2026-48071

OpenReception's appointment booking software (prior to version 1.0.4) has a vulnerability in the PIN-type challenge throttle. The throttle uses emailHash as the single key, with throttle rows stored in a shared central challenge_throttle table across tenants. As a result, failing challenges in on...

CVE-2026-48071 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

easywall v2.4.1

easywall Your firewall. Your rules. No surprises. Live demo · Documentation · Changelog nftables through a web interface that cannot lock you out: every apply reverts itself unless you confirm it. !The easywall dashboard: firewall status with acceptance state, pending changes and last apply; tile...

CVE-2024-6832

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

CVE-2024-6832

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

CVE-2024-6832

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

CVE-2024-6832 Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

CVE-2024-6832 Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

EUVD-2024-55707

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

CVE-2024-6832

CVE-2024-6832 describes an account locking failure in multiple WSO2 products where the lockout is not triggered if secondary user stores are inaccessible. The root cause is that the system does not maintain a consistent lockout state across all configured stores, enabling an attacker to perform r...

CVE-2026-14204

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim o...

CVE-2026-14204 Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim o...

CVE-2026-14204: Cross-Site Request Forgery (CSRF)

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim o...