최근 6개월의 모든 CVE를 매일 업데이트합니다.

9개 중 9개 표시

• 중간CVE-2026-79763CVSS 점수 5.32026. 9. 24.

  Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthenticat

  CWE-308
• 치명CVE-2026-58240CVSS 점수 9.82026. 9. 8.

  SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unaut

  CWE-308
• 높음CVE-2026-85590CVSS 점수 7.12026. 9. 4.

  phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig() handler (reachable via POST /api/user/remove-twofactor) verifies only that the user is logged in an

  CWE-308
• 높음CVE-2026-67611CVSS 점수 8.12026. 8. 3.

  OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration end

  CWE-308open-emr openemr
• 치명CVE-2026-15616CVSS 점수 9.12026. 7. 23.

  Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

  CWE-308
• 중간CVE-2026-56022CVSS 점수 5.32026. 6. 18.

  Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.

  CWE-308webmin webmin
• 중간CVE-2024-27928CVSS 점수 5.92026. 6. 17.

  vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, they can 1) reset the password via email and then 2) reset the 2FA token via email. This way they redu

  CWE-308
• 높음CVE-2026-45749CVSS 점수 8.12026. 6. 5.

  Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /users/totp/disable` and `POST /users/totp/backup-codes` endpoints in Termix prior to version 2.3.2 accept the account password as a sole au

  CWE-308termix termix
• 낮음CVE-2026-33550CVSS 점수 2.02026. 3. 22.

  SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).

  CWE-308alinto sogo