PatchTheCVE: two-factor authenticationhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-7030: Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploitinhttps://patchthecve.com/cve/CVE-2025-7030.htmlhttps://patchthecve.com/cve/CVE-2025-7030.htmlWed, 17 Jun 2026 10:04:07 +0000MEDIUM 6.5: Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.CVE-2025-31694: Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This https://patchthecve.com/cve/CVE-2025-31694.htmlhttps://patchthecve.com/cve/CVE-2025-31694.htmlWed, 17 Jun 2026 09:10:47 +0000HIGH 8.1: Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.CVE-2024-13279: Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue afhttps://patchthecve.com/cve/CVE-2024-13279.htmlhttps://patchthecve.com/cve/CVE-2024-13279.htmlWed, 17 Jun 2026 07:01:40 +0000CRITICAL 9.8: Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.CVE-2024-13239: Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This ihttps://patchthecve.com/cve/CVE-2024-13239.htmlhttps://patchthecve.com/cve/CVE-2024-13239.htmlWed, 17 Jun 2026 07:01:33 +0000CRITICAL 9.8: Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.CVE-2022-4536: The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and inhttps://patchthecve.com/cve/CVE-2022-4536.htmlhttps://patchthecve.com/cve/CVE-2022-4536.htmlWed, 17 Jun 2026 05:21:08 +0000MEDIUM 5.3: The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-ForwardedCVE-2024-5658: The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within https://patchthecve.com/cve/CVE-2024-5658.htmlhttps://patchthecve.com/cve/CVE-2024-5658.htmlWed, 17 Jun 2026 08:16:22 +0000MEDIUM 4.8: The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.CVE-2024-5657: The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash ohttps://patchthecve.com/cve/CVE-2024-5657.htmlhttps://patchthecve.com/cve/CVE-2024-5657.htmlWed, 17 Jun 2026 08:16:22 +0000LOW 3.7: The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.