CVE-2026-82228

SiteGround Security WordPress plugin versions ≤ 1.6.6 are affected by an unauthenticated 2FA Bypass vulnerability, discovered by Ananda Dhakal via Patchstack. The flaw allows a network-based attacker (with high attack complexity, no prior privileges or user interaction) to bypass two-factor authe...

Linux Distros Unpatched Vulnerability : CVE-2026-82470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp...

SUSE CVE-2026-61790

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...

BIT-KEYCLOAK-2025-3910 Org.keycloak.authentication: two factor authentication bypass

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

Insufficiently Protected Credentials

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the offsetGet process. An attacker can retrieve sensitive user information, such as hashed passwords...

CVE-2026-59799

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...

CVE-2026-59799 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...

EUVD-2026-63841

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...

CVE-2026-59799: Improper Privilege Management

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...

PT-2026-79322

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper Privilege Management in the Two-factor authentication plugin allows for the bypass of the two-factor authentication...

CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...

Brute Force

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Brute Force via the two-factor authentication process. An attacker can bypass the attempt limit by repeatedly re-authenticating with a valid password to...

Brute Force

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Brute Force via the two-factor authentication process. An attacker can bypass the attempt limit by repeatedly re-authenticating with a valid password to...

CVE-2026-62666

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...

CVE-2026-62669

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

EUVD-2026-62544

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer...

CVE-2026-62669 Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-62669

Grav Login Plugin (for Grav CMS) prior to 3.8.11 contains a two-factor authentication bypass in the login.regenerate2FASecret task. The root cause is an insufficient authorization check: the task verifies only that the pending-session user exists rather than requiring $user->authorized. An att...

CVE-2026-62666 Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...

CVE-2026-62666 Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...