https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 17:36:51 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-105835 <p>PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user&#39;s password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.</p> <p>PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user&#39;s password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-105835 https://vulnerability.circl.lu/vuln/ghsa-vxgr-w3f5-4g4j <p>PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user&#39;s password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.</p> <p>PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user&#39;s password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.</p> https://vulnerability.circl.lu/vuln/ghsa-vxgr-w3f5-4g4j