https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:16:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-263064 EUVD-2026-263064 https://cve.radiocsirt.org/vuln/euvd-2026-263064 https://cve.radiocsirt.org/vuln/fkie_cve-2025-67507 <p>Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.</p> <p>Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-67507 https://cve.radiocsirt.org/vuln/ghsa-pvcv-q3q7-266g <p><strong>Affected:</strong> Packagist: filament/filament</p> <p>A flaw in the handling of recovery codes for **app-based multi-factor authentication** allows the same recovery code to be reused indefinitely. This issue does **not** affect email-based MFA. It also only applies when recovery codes are enabled.</p> <p>If an attacker gains access to both the user&#39;s password and their recovery codes, they can repeatedly complete MFA without the user&#39;s app-based second factor. This weakens the expected security of MFA by turning recovery codes into a static, long-term bypass method.</p> <p><strong>Affected:</strong> Packagist: filament/filament</p> <p>A flaw in the handling of recovery codes for **app-based multi-factor authentication** allows the same recovery code to be reused indefinitely. This issue does **not** affect email-based MFA. It also only applies when recovery codes are enabled.</p> <p>If an attacker gains access to both the user&#39;s password and their recovery codes, they can repeatedly complete MFA without the user&#39;s app-based second factor. This weakens the expected security of MFA by turning recovery codes into a static, long-term bypass method.</p> https://cve.radiocsirt.org/vuln/ghsa-pvcv-q3q7-266g