CVE-2026-43914-PoC

CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection Bypass Proof-of-concept for CVE-2026-43914 : when Email 2FA is enabled, Vaultwarden's login brute-force protection can be completely bypassed via the unauthenticated POST /api/two-factor/send-email-login endpoint, which acts as an...

CVE-2026-93635

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...

CVE-2026-93635 Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...

CVE-2026-93635 Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...

CVE-2026-93635

The Zimbra Collaboration Suite (versions 10.1.0 through 10.1.21) is vulnerable to an LDAP filter injection caused by unescaped computeDn() template substitutions. This flaw allows unauthenticated attackers to manipulate external LDAP search filters. In environments utilizing search-filter authent...

EUVD-2026-101457

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...

CVE-2026-93635: Improper Neutralization of Special Elements used in an LDAP Query

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...

PT-2026-114349

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...

GHSA-XWPV-PQXP-5V36 Filament: Password validity disclosure for accounts denied panel access on login page

When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating canAccessPanel. For an account that canAccessPanel denies, submitting the correct password renders the challenge while an incorrect password returns the generic failure message,...

CVE-2026-84307

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...

EUVD-2026-69556

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...

PT-2026-84401

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.5 Filament versions prior to 5.7.5 Description The login page presents the multi-factor authentication MFA challenge before evaluating the canAccessPanel function. For accounts where canAccessPanel denies access...

Exploit for Improper Restriction of Excessive Authentication Attempts in Dani-Garcia Vaultwarden

CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection...

WordPress Quiz and Survey Master (QSM) plugin < 11.1.3 - Unauthenticated User Enumeration and Password Oracle vulnerability

Unauthenticated User Enumeration and Password Oracle vulnerability discovered by Ahmad Mubarak Alanazi in WordPress Plugin Quiz And Survey Master versions 11.1.3...

CVE-2025-36758

CVE-2025-36758 relates to a bypass of bruteforce protection in SolaX Cloud . Multiple sources (NVD, Red Hat, CVE listings) describe that the vulnerability allows bypassing the authentication attempt clipping level via the Forgot Password flow, effectively acting as an oracle. The core affected pr...