CVE-2026-49470 GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

CVE-2026-49470 GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

EUVD-2026-87282

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

CVE-2026-49470

The asset management software GLPI versions 11.0.0 through 11.0.7 contains a vulnerability where the time-based one-time password (TOTP) verification endpoint lacks a limit on failed submissions per user. An attacker possessing a user's primary credentials can perform a brute-force attack against...

CVE-2026-49470 GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

CVE-2026-61855 Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid "Good" PGP signature from a registered sender key, even though the displayed message content i...

CVE-2026-61855 Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid "Good" PGP signature from a registered sender key, even though the displayed message content i...

CVE-2026-61855 Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid "Good" PGP signature from a registered sender key, even though the displayed message content i...

CVE-2026-61855

The open source helpdesk system Zammad versions 7.0.3 and 7.1.1 is vulnerable to an issue where inbound PGP-signed emails may be incorrectly marked with a valid ("Good" ) signature status. This occurs under certain conditions because the verification process can identify a valid signature from a ...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

EUVD-2026-87265

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465

The open source helpdesk system Zammad is vulnerable to sender impersonation in versions prior to 7.1.2 . The root cause is that the system fails to verify if an S/MIME-signed email's certificate is genuinely trusted; instead, it only checks if a certificate with a matching name exists in the sys...

CVE-2026-97063

The X-SpringBoot framework, versions through 6.0 , is vulnerable to an authentication bypass due to the exposure of login verification codes. The application returns these codes directly in HTTP responses from unauthenticated endpoints, specifically GET /sys/mobile/code and GET /sys/email/code , ...

CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

CVE-2026-56727

The open-source helpdesk system Zammad is vulnerable to PGP signature spoofing prior to version 7.0.2 . The root cause is that the system silently discards the return value of the gpg verification call during inbound PGP email processing. Consequently, the handler unconditionally writes a success...

CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

LinkedIn adds new checks for fake profiles and work histories

LinkedIn is adding trust and verification features aimed at making fake professional identities, invented work histories, and company impersonation harder to pull off. The company is responding to an environment in which generative AI enables imposters to create an entirely made-up professional...