50803 matches found
CVE-2026-85590 phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...
BIT-JOOMLA-2026-73337 Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2
Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-85590: Use of Single-factor Authentication
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...
PT-2026-85488
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.8 Description User data export ZIP files contain live Time-based One-Time Password TOTP shared secrets in plaintext. An attacker who obtains these exported archives can extract the TOTP seed to generate valid...
CVE-2026-85588: Exposure of Sensitive Information to an Unauthorized Actor
phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...
PT-2026-85490
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...
CVE-2026-85237
A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...
EUVD-2026-62540
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge...
CVE-2026-84479
WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...
CVE-2026-84479 WWBN AVideo Authentication Bypass via User-Agent Header
WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...
CVE-2026-84479 WWBN AVideo Authentication Bypass via User-Agent Header
WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...
CVE-2026-84479 WWBN AVideo Authentication Bypass via User-Agent Header
WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...
CVE-2026-84479
WWBN AVideo (version e01e41ecc and earlier) contains an authentication bypass vulnerability where three login-time security controls rely solely on the client-supplied User-Agent header. The isAVideoEncoder() and isAVideoMobileApp() checks match HTTP_USER_AGENT against hardcoded literals ("AVideo...
CLSA-2026-1788286444 TuxCare security update for nuxt (2 CVEs)
TuxCare rebuilt nuxt to address 2 CVEs. Fixed in 0.10.7-tuxcare.4...
CLEANSTART-2026-ZX66437 Security fixes in cadvisor 0.60.5-r0
Package cadvisor version 0.60.5-r0 fixes 2 vulnerabilities: ghsa-259r-337f-4rfw, ghsa-hrxh-6v49-42gf...
CLEANSTART-2026-SU87029 Security fixes in argo-cd 3.3.12-r4
Package argo-cd version 3.3.12-r4 fixes 2 vulnerabilities: ghsa-259r-337f-4rfw, CVE-2026-41178...
CLSA-2026-1788248501 TuxCare security update for 32 packages (1 CVE)
TuxCare rebuilt 32 packages to address 1 CVE. Fixed in 7.0.70-tuxcare.2...
CVE-2026-84479: Authentication Bypass by Spoofing
WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...
CVE-2026-82228
SiteGround Security WordPress plugin versions ≤ 1.6.6 are affected by an unauthenticated 2FA Bypass vulnerability, discovered by Ananda Dhakal via Patchstack. The flaw allows a network-based attacker (with high attack complexity, no prior privileges or user interaction) to bypass two-factor authe...