phpMyFAQ before 4.1.7 (affected versions <= 4.1.5) fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the muta...

CVE-2026-76214

phpMyFAQ before 4.1.7 (affected versions <= 4.1.5) fails to persist the WebAuthn login challenge generated by prepareFor

历史摘要 · 未重新核验 · NVD

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to repl...

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted devi

历史摘要 · 未重新核验 · NVD

http4k: `DigestAuthProvider.verify` did not bind to request URI

CVE-2026-54148

### Impact An issue in `DigestAuthProvider.verify`: The `uri` parameter in the client's `Authorization: Digest …` resp

历史摘要 · 未重新核验 · GitHub Advisory

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows...

CVE-2026-73683

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attack

历史摘要 · 未重新核验 · GitHub Advisory

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the m...

CVE-2026-73683

Laravel Socialite是一个流行的社交登录OAuth库，其Facebook提供者存在一个认证绕过漏洞（CVE-2026-73683）。漏洞根因在于FacebookProvider.php中的getUserByOIDCToken(

历史摘要 · 未重新核验 · NVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management.

CVE-2026-17045

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access s

历史摘要 · 未重新核验 · NVD

ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

CVE-2026-55088

Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext autho

历史摘要 · 未重新核验 · GitHub Advisory

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token.

CVE-2026-17268

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper

历史摘要 · 未重新核验 · NVD

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateles...

CVE-2026-73431

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Ac

历史摘要 · 未重新核验 · NVD

nimiq-blockchain: Validity store off by one error

CVE-2026-46369

### Impact The validity store treats a transaction with stored `block_number = X` as "in window" only when `X > last_bn

历史摘要 · 未重新核验 · GitHub Advisory

Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-62911

Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges

历史摘要 · 未重新核验 · NVD

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login reque...

CVE-2026-72780

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey

历史摘要 · 未重新核验 · NVD

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Craft CMS passkey login accepts WebAuthn requestOptions from the unauthenticated login request body and does not persist

历史摘要 · 未重新核验 · GitHub Advisory

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCo...

CVE-2026-68079

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of

历史摘要 · 未重新核验 · NVD

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fa...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured a

历史摘要 · 未重新核验 · NVD

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

CVE-2026-20779

### Summary I'm reporting **two related TOTP one-time-use defects** in Gitea that survive the CVE-2021-45331 fix. The 2

历史摘要 · 未重新核验 · GitHub Advisory

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Li...

CVE-2026-47133

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.

历史摘要 · 未重新核验 · NVD

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP response...

CVE-2026-56453

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can inter

历史摘要 · 未重新核验 · NVD

HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authenticatio...

CVE-2026-35141

HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to interce

历史摘要 · 未重新核验 · NVD

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by int...

CVE-2026-35149

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized us

历史摘要 · 未重新核验 · NVD