https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:15:49.189387+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-351209 EUVD-2026-351209 2026-10-06T11:15:49.243229+00:00 EUVD-2026-351209 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72780 fkie_cve-2026-72780 2026-10-06T11:15:49.243273+00:00

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.

 https://cve.radiocsirt.org/vuln/ghsa-jh4m-63fq-p9h9 GHSA-jh4m-63fq-p9h9 2026-10-06T11:15:49.243307+00:00

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.