CVE-2026-48154: Concurrent Execution using Shared Resource with Improper Synchronization

GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and...

CVE-2026-35597: Improper Restriction of Excessive Authentication Attempts

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/api/v1/login.go calls HandleFailedTOTPAuth and then...

WS-2016-7092

In “moby/moby”, v1.7.0 to v1.10.0 there is a misconfiguration and a bad authentication logic in login.go that allows config users to successfully authenticate the second time if they typed incorrect password in the first authentication...