https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T19:13:33.458279+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-128332 CVE-2026-128332 — listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa 2026-11-13T19:13:33.461408+00:00

Affected: knadh listmonk

Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin.