CVE-2026-54418

CVE-2026-54418 affects Leantime up to version 3.6.2. The JSON-RPC endpoints leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA accept a caller-supplied userId without ownership checks, session pinning, or permission-attribute gating. An authenticated user can call ...

Denial Of Service (DoS)

cordova-plugin-fingerprint-aio is vulnerable to denial of service. The vulnerability exists in saveSecret of Fingerprint.swift due to improper handling of data which leads to an application crash...