2288 matches found
PT-2026-44707
Name of the Vulnerable Software and Affected Versions Drupal TFA Basic Plugins versions 7.x-1.0 through 7.x-1.2 Description An access bypass issue allows users possessing the administer users permission to view or generate recovery codes for other users. Recommendations Update Drupal TFA Basic...
Drupal TFA Basic Plugins 安全漏洞
Drupal TFA Basic Plugins is a set of Drupal two-factor authentication extensions developed by the Drupal company. Versions 7.x-1.0 to 7.x-1.2 of Drupal TFA Basic Plugins contain security vulnerabilities. These vulnerabilities stem from access bypass issues, which could allow users with...
USN-8315-1 mediawiki vulnerabilities
It was discovered that MediaWiki incorrectly handled group membership visibility in the OATHAuth extension. An authenticated attacker could use this issue to determine if other users had two-factor authentication enabled. CVE-2026-34087 It was discovered that MediaWiki incorrectly handled...
CVE-2026-8903
The CVE concerns the WordPress plugin “Two-factor authentication (formerly IP Vault)” up to version 2.1. It is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation in ipv_save_changes. This allows unauthenticated attackers to modify the plugin’s firewall and two-f...
CVE-2026-8903 Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update
The Two-factor authentication formerly IP Vault plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the ipvsavechanges function. This makes it possible for unauthenticated attackers to...
CVE-2026-8903 Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update
The Two-factor authentication formerly IP Vault plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the ipvsavechanges function. This makes it possible for unauthenticated attackers to...
CVE-2026-8903: Cross-Site Request Forgery (CSRF)
The Two-factor authentication formerly IP Vault plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the ipvsavechanges function. This makes it possible for unauthenticated attackers to...
WordPress plugin Two-factor authentication 跨站请求伪造漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
WordPress Two-factor authentication (formerly IP Vault) plugin <= 2.1 - Cross-Site Request Forgery to Settings Update vulnerability
Cross-Site Request Forgery to Settings Update vulnerability discovered by afnaan - SMKN 1 Bantul in WordPress Plugin IP Vault – WP Firewall versions = 2.1...
CVE-2026-48896
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48896
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
EUVD-2026-31890
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48897
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
EUVD-2026-31883
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
PT-2026-43314
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Insufficient state checks create a vector that allows the bypass of two-factor authentication 2FA checks. Recommendations At the moment, there is no information...
PT-2026-43315
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Insufficient state checks create a vector that allows the bypass of two-factor authentication 2FA checks. Recommendations At the moment, there is no information...
npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve a release prior to the packages becoming publicly available for installation. Called staged publishing, the feature is now generally available on...
Authen::TOTP 安全特征问题漏洞
Authen::TOTP is a two-factor authentication OTP generation and verification tool developed by tchatzi’s developer. Prior to version 0.1.1 of Authen::TOTP, there were security vulnerabilities related to the use of the Perl built-in rand function for generating secrets. This function is predictable...
Domijn: The Security of Domain Registrars and the Risk of a Domain Name Takeover
Domain names are key assets for organisation. They anchor an organisation's online presence and reputation, and serve as linking pin for web services and, e.g., email. Consequently, a malicious takeover of a domain can lead to significant damages. Organisations register domain names through...
CVE-2026-45010
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by...