SYNwall

SYNwall Zero config IoT firewall. SYNwall is a project built for the time being as a Linux Kernel Module, to implement a transparent and no-config/no-maintenance firewall. You may want to have a look to the for an example of usage. Basics Usually IoT devices are out of a central control, with low...

Seecret.it

📦 Seecret.it — Secure sharing via one-time link Seecret.it is an online service for sharing passwords, documents or sensitive information via encrypted one-time links. Your data remains invisible, secure, and self-destructs after viewing. Ideal for IT teams, businesses, freelancers, and anyone...

Microsoft365_devicePhish

Microsoft365devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack This is a simple proof-of-concept script that allows an attacker to conduct a phishing attack against Microsoft 365 OAuth Authorization Flow. Using this, one can connect to Microsoft's OAuth API endpoints t...

ONe-TIME-ecb-oracle-attack-AES

ONe-TIME-ecb-oracle-attack-AES...

Composable Device-Independent Quantum Digital Signatures

Extending device-independent DI quantum cryptography to composably support all fundamental information security objectives is crucial for secure quantum networks. Achieving this goal requires composable quantum digital signatures QDSs, which support integrity, authenticity, and nonrepudiation whe...

CVE-2026-110508

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when bo...

PT-2026-128089

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when bo...

Medium: ipa

Issue Overview: A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. Th...

CVE-2026-16648

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7...

CVE-2026-110135

The OTP Login & Register Woocommerce WordPress plugin, in versions before 2.7.3 , is vulnerable to an unauthenticated account takeover due to a failure in limiting one-time-password (OTP) verification attempts. The root cause is that the plugin tracks the attempt limit against a client-supplied v...

EUVD-2026-102696

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and...

CVE-2026-94256

The SMS Alert WordPress plugin, in versions prior to 4.0.1 , contains an improper authentication vulnerability (CWE-287). The root cause is a failure to verify that the account being accessed matches the account associated with a verified one-time code. This allows unauthenticated attackers to by...

CLSA-2026-1791558713 Fix CVE(s): CVE-2026-73636, CVE-2026-73637

SECURITY UPDATE: one-time nonce replay and use-after-free in modauthdigest - debian/patches/CVE-2026-73636CVE-2026-73637.patch: accept a one-time nonce or nonce-count only when it is newer than the one last recorded for the client, and send a stale challenge when the client entry is no longer...

EUVD-2024-55782

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...

PT-2026-107723

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...

DRUPAL-CONTRIB-2026-197

This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...

CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests

MISP contains a race condition in the email-based one-time password OTP login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store,...

PT-2026-107747

This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...

Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...

CVE-2026-103514

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...