CVE-2026-76213

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in its two-factor authentication step. The root cause is that the TOTP failure counter is session-scoped and resets on each successful password re-authentication. An attacker who already possesses a valid password can bypass the five-atte...

PT-2026-78487

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11 Description The login.regenerate2FASecret task fails to verify if a user is authorized, checking only for the existence of a pending-session user. An attacker who has obtained a victim's password can...

CVE-2026-62988

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and...

GHSA-7788-GHFQ-C6MH Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affected endpoints retrieve full database rows using SELECT , SELECT alias., or equivalent full-row queries, then return the results directly through $this-response... without removing...

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affected endpoints retrieve full database rows using SELECT , SELECT alias., or equivalent full-row queries, then return the results directly through $this-response... without removing...

EUVD-2026-61216

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and...

CVE-2026-62988 Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and...

CVE-2026-62988 Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and...

CVE-2026-62988

Froxlor versions 2.3.7 through 2.3.8 expose password hashes and Base32-encoded TOTP seeds via API endpoints (Customers, Admins, Ftps commands). An authenticated caller can crack hashes offline and generate valid 2FA codes, enabling full account takeover. Upgrade to 2.3.8 and reset 2FA secrets for...

PT-2026-77303

Name of the Vulnerable Software and Affected Versions Froxlor versions 2.3.7 through 2.3.7 Description Certain API commands retrieve full database rows and return them without removing sensitive fields. An authenticated API caller with appropriate permissions can obtain password hashes and...

CVE-2026-74878

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

EUVD-2026-60097

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

CVE-2026-74878 openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

CVE-2026-74878 openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

CVE-2026-74878

openssl_encrypt versions before 1.4.0 contain a TOTP brute-force rate limiter bypass in openssl_encrypt_server/modules/pepper/totp.py. The TOTPRateLimiter class stores attempt and lockout state in an in-memory defaultdict(list) as a class variable, meaning rate-limit state is not shared across wo...

CVE-2026-49467

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

EUVD-2026-57356

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

CVE-2026-49467

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

CVE-2026-49467 TOTP enrollment hijack: password gate skipped due to unawaited promise

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

CVE-2026-49467

CVE-2026-49467 affects Pingvin Share X (versions 1.5.0 through 1.18.0). The root cause is a missing await on asynchronous calls to verifyPassword (authTotp.service.ts) and authenticateUser (auth.service.ts). In JavaScript, an unawaited Promise is truthy, so the intended ForbiddenException when a ...