CVE-2026-107638

Published 8 October 2026 · tracked since 9 October 2026

Description

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-107294 MEDIUM 6.5
• CVE-2026-107295 HIGH 7.6
• CVE-2026-107296 LOW 3.7
• CVE-2026-107297 MEDIUM 5.9
• CVE-2026-107290 MEDIUM 6.5
• CVE-2026-107291
• CVE-2026-107292 MEDIUM 6.4
• CVE-2026-107293
• CVE-2026-105436 HIGH 8.8
• CVE-2026-104077 HIGH 7.8

→ Open the live CVE board · all tools