https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 07:47:28 +0000 https://cve.radiocsirt.org/vuln/cve-2026-16035 <p><strong>Affected:</strong> Unknown miniOrange 2FA</p> <p>The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user&#39;s own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site&#39;s metered OTP allowance, preventing legitimate users from receiving their second-factor codes.</p> <p><strong>Affected:</strong> Unknown miniOrange 2FA</p> <p>The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user&#39;s own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site&#39;s metered OTP allowance, preventing legitimate users from receiving their second-factor codes.</p> https://cve.radiocsirt.org/vuln/cve-2026-16035