CVE-2026-43914-PoC

CVE-2026-43914 — Omisión de la protección de fuerza bruta del Email-2FA de Vaultwarden Prueba de concepto para CVE-2026-43914 : cuando Email 2FA está habilitado, la protección de fuerza bruta del inicio de sesión de Vaultwarden puede omitirse por completo a través del endpoint no autenticado POST...

GHSA-XWPV-PQXP-5V36 Filament: Password validity disclosure for accounts denied panel access on login page

When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating canAccessPanel. For an account that canAccessPanel denies, submitting the correct password renders the challenge while an incorrect password returns the generic failure message,...

CVE-2026-84307

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...

EUVD-2026-69556

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...

PT-2026-84401

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.5 Filament versions prior to 5.7.5 Description The login page presents the multi-factor authentication MFA challenge before evaluating the canAccessPanel function. For accounts where canAccessPanel denies access...

Exploit for Improper Restriction of Excessive Authentication Attempts in Dani-Garcia Vaultwarden

CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection...

WordPress Quiz and Survey Master (QSM) plugin < 11.1.3 - Unauthenticated User Enumeration and Password Oracle vulnerability

Unauthenticated User Enumeration and Password Oracle vulnerability discovered by Ahmad Mubarak Alanazi in WordPress Plugin Quiz And Survey Master versions 11.1.3...

CVE-2025-36758

CVE-2025-36758 relates to a bypass of bruteforce protection in SolaX Cloud . Multiple sources (NVD, Red Hat, CVE listings) describe that the vulnerability allows bypassing the authentication attempt clipping level via the Forgot Password flow, effectively acting as an oracle. The core affected pr...