Alexandregz
Vulnerability activity for Alexandregz: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.3MediumOct 27, 2026Alexandregz twofactor gauthenticator Auth bypass / access controlCVE-2026-107147The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed. This issue was fixed in commit 4640889.
- 6.3MediumOct 27, 2026Alexandregz twofactor gauthenticatorCVE-2026-107146The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code. This issue was fixed in commit 4640889.
- 6.3MediumOct 27, 2026Alexandregz twofactor gauthenticatorCVE-2026-107145The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This issue was fixed in commit 4640889.
Top products
- twofactor gauthenticator3 CVEs in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- ENISA EUVD · Oct 27, 2026EUVD-2026-110649 · The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed…CVE-2026-107147
- ENISA EUVD · Oct 27, 2026EUVD-2026-110648 · The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA…CVE-2026-107146
- ENISA EUVD · Oct 27, 2026EUVD-2026-110647 · The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor…CVE-2026-107145
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.