Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
150 results · page 1 of 3
Oct 28, 2026Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote CVE-2026-104383 · Other software · EagleCloud · reported by mandiant-cve@google.comCritical 9.4
Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection
- Product
- Aquila
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA vCVE-2026-107671 · Other software · Veeam · reported by support@hackerone.comHigh 8.5
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.
- Product
- ONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism.CVE-2026-108071 · Other software · TSplus · reported by cve-coordination@incibe.esHigh 8.7
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
- Product
- TSplus Remote Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA).CVE-2024-8122 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 5.9
The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the OTP. The absence of automatic expiration for OTPs grants attackers an unlimited timeframe to attempt guessing the correct code. A successful brute force attack can lead to an MFA bypass, resulting in the unauthorized takeover of a user's account and compromising the security and privacy of both the individual and the system.
- Product
- WSO2 Identity Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Sep 29, 2026Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an remembCVE-2026-92227 · Websites & servers · reported by security@joomla.orgHigh 8.2
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgjoomla.org
Sep 26, 2026stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket wiCVE-2026-100679 · Other software · stoatchat · reported by VulnCheckHigh 7.1
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.
- Product
- stoatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 26, 2026stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with oCVE-2026-100678 · Other software · stoatchat · reported by VulnCheckHigh 8.3
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.
- Product
- stoatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 20, 2026A vulnerability has been found in Comfast CF-N1-S 2.6.0.1.CVE-2026-94003 · Other software · Comfast · reported by VulDBCritical 9.3
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- CF-N1-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2026SEP sesam before 5.2.0.24 mishandles User Authorization with MFA.CVE-2026-79300 · Other software · SEP · reported by MITRELow 3.5
SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user accounts to be created for the same Active Directory (AD) account. Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes between different letter casing. As a result, the same AD user can be represented by multiple SEP sesam user accounts that differ only in username capitalization. When Active Directory authentication is configured and multi-factor authentication (MFA) is enforced, this behavior may allow an additional OTP Authenticator to be registered for the same AD account, reducing the effectiveness of MFA protection.
- Product
- sesam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion.CVE-2026-78631 · Other software · Okta · reported by psirt@okta.comMedium 5.3
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.
- Product
- Okta Hyperdrive Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user.CVE-2026-78629 · Other software · Okta · reported by psirt@okta.comMedium 5.6
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.
- Product
- Okta Hyperdrive Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name CVE-2026-75364 · Other software · reported by MITREMedium 6.8
Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter. User-controlled input is concatenated via sprintf() into the unquoted shell command `/etc/rrd/graphinterface %s %s` and executed by system() with root privileges. A remote authenticated attacker can inject arbitrary commands
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters tCVE-2026-75363 · Other software · reported by MITREMedium 6.8
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, display_n.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026A vulnerability was found in Comfast CF-N1-S 2.6.0.1.CVE-2026-78050 · Other software · Comfast · reported by VulDBHigh 8.6
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_client_enabled results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used.
- Product
- CF-N1-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1.CVE-2026-77683 · Other software · Comfast · reported by VulDBHigh 8.6
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- Product
- CF-N1-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A vulnerability was found in Comfast CF-N1-S 2.6.0.1.CVE-2026-77148 · Other software · Comfast · reported by VulDBHigh 8.6
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
- Product
- CF-N1-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1.CVE-2026-77022 · Other software · Comfast · reported by VulDBHigh 8.6
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
- Product
- CF-N1-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A flaw has been found in Comfast CF-N1-S 2.6.0.1.CVE-2026-77004 · Other software · Comfast · reported by VulDBLow 2.1
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
- Product
- CF-N1-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026A flaw has been found in Comfast CF-N1-S 2.6.0.1.CVE-2026-76008 · Other software · Comfast · reported by VulDBCritical 10
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.
- Product
- CF-N1-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2CVE-2026-73337 · Websites & servers · reported by security@joomla.orgHigh 8.2
Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgjoomla.org
Aug 17, 2026A flaw has been found in COMFAST CF-N1-S 2.6.0.1.CVE-2026-75094 · Other software · COMFAST · reported by VulDBHigh 8.5
A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
- Product
- CF-N1-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2026A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1.CVE-2026-19976 · Other software · COMFAST · reported by VulDBLow 2
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-N1-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.CVE-2026-16971 · Other software · dfir-iris · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aMedium 5.9
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
- Product
- iris-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.CVE-2026-15616 · Other software · Logto · reported by cret@cert.orgCritical 9.1
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
- Product
- Logto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID wCVE-2026-22049 · Other software · NETAPP · reported by security-alert@netapp.comHigh 8.7
ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.
- Product
- ONTAP 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd.CVE-2026-4773 · Other software · Magarsus Consulting Ltd. Co. · reported by iletisim@usom.gov.trHigh 8.1
Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10.
- Product
- IDM-MFA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8.CVE-2026-15511 · Other software · Comfast · reported by VulDBHigh 8.9
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-WR631AX V3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Lack of validation leads to an XSS vulnerability in the MFA management views.CVE-2026-48949 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of validation leads to an XSS vulnerability in the MFA management views.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2026A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8.CVE-2026-12814 · Other software · Comfast · reported by VulDBLow 2.1
A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=ping_config of the component API Endpoint. This manipulation of the argument destination causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-WR631AX V3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requireCVE-2026-56022 · Other software · Webmin · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 6.9
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
May 28, 2026Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements.CVE-2026-9091 · Other software · Casdoor · reported by cret@cert.orgMedium 5.3
Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable. Any user authenticating via this path is logged in without MFA enforcement.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1.CVE-2026-6799 · Other software · Comfast · reported by VulDBLow 2.1
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is some unknown functionality of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component Endpoint. Performing a manipulation of the argument destination results in command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-N1-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own confiCVE-2026-5175 · Other software · Devolutions · reported by security@devolutions.netMedium 5
Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server: from 2026.1.6 through 2026.1.11.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys viaCVE-2026-4927 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove theCVE-2026-4925 · Other software · Devolutions · reported by security@devolutions.netMedium 5
Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request. This issue affects Server: from 2026.1.6 through 2026.1.11.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI pCVE-2025-55988 · Other software · Dreamfactory · reported by MITREHigh 7.2
An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.
- Product
- Dreamfactory Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compentest-tools.com
Mar 20, 2026A vulnerability was determined in Comfast CF-AC100 2.6.0.8.CVE-2026-4468 · Other software · Comfast · reported by VulDBLow 2
A vulnerability was determined in Comfast CF-AC100 2.6.0.8. Affected is an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=update_interface_png. This manipulation causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-AC100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026A vulnerability was found in Comfast CF-AC100 2.6.0.8.CVE-2026-4467 · Other software · Comfast · reported by VulDBLow 2
A vulnerability was found in Comfast CF-AC100 2.6.0.8. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=wireless_device_dissoc. The manipulation results in command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-AC100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026A vulnerability has been found in Comfast CF-AC100 2.6.0.8.CVE-2026-4466 · Other software · Comfast · reported by VulDBLow 2
A vulnerability has been found in Comfast CF-AC100 2.6.0.8. This affects an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. The manipulation leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-AC100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026The extension fails to properly reset the generated MFA code after successful authentication.CVE-2026-4208 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.7
The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.
- Product
- Extension "E-Mail MFA Provider"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required.CVE-2025-69615 · Other software · Telekom · reported by MITRECritical 9.1
Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03.
- Product
- Account Management Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comtelekom.com
Mar 9, 2026A vulnerability was detected in Comfast CF-AC100 2.6.0.8.CVE-2026-3798 · Other software · Comfast · reported by VulDBLow 2
A vulnerability was detected in Comfast CF-AC100 2.6.0.8. This affects the function sub_44AC14 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component Request Path Handler. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-AC100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A flaw has been found in Comfast CF-E7 2.6.0.9.CVE-2026-2824 · Other software · Comfast · reported by VulDBLow 2.1
A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-E7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A vulnerability was detected in Comfast CF-E7 2.6.0.9.CVE-2026-2823 · Other software · Comfast · reported by VulDBLow 2.1
A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-E7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A vulnerability was identified in Comfast CF-E4 2.6.0.1.CVE-2026-2537 · Other software · Comfast · reported by VulDBLow 2
A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component HTTP POST Request Handler. Such manipulation of the argument timestr leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-E4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A vulnerability was found in Comfast CF-N1 V2 2.6.0.2.CVE-2026-2535 · Other software · Comfast · reported by VulDBLow 2.1
A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel. The manipulation of the argument channel results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-N1 V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2026A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2.CVE-2026-2534 · Other software · Comfast · reported by VulDBLow 2.1
A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_bandwidth. The manipulation of the argument bandwidth leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CF-N1 V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025FormFacade: Cross-Site Request Forgery (CSRF)CVE-2025-62133 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in manidoraisamy FormFacade formfacade allows Cross Site Request Forgery.This issue affects FormFacade: from n/a through <= 1.4.1.
- Product
- FormFacade
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update FormFacade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025DreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability.CVE-2025-13700 · Other software · DreamFactory · reported by zdi-disclosures@trendmicro.comHigh 7.2
DreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of DreamFactory. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the saveZipFile method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26589.
- Product
- DreamFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 18, 2025BullWall Server Intrusion Protection has a noticeable configuration-dependent delay before the MFA check for RDP connections.CVE-2025-62003 · Other software · BullWall · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.7
BullWall Server Intrusion Protection has a noticeable configuration-dependent delay before the MFA check for RDP connections. A remote, authenticated attacker can potentially bypass detection during this delay. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected.
- Product
- Server Intrusion Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.