CVE-2026-33550

LowCVSS 2.6/10Last modified Jun 17, 2026

Description

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).

Metrics

CVSS 3.1 2.6/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-308

Affected software

No affected versions have been published.

Timeline

Published
Mar 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-335515.3An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials caCVE-2026-335523.7Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.CVE-2026-335536.1Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS.CVE-2026-335547.5ipmi-oem in FreeIPMI before 1.6.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMCVE-2026-335555.8An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announcCVE-2026-335579.1A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.clasCVE-2026-335585.3Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responsCVE-2026-335595.1WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of thCVE-2026-33569.3The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its mCVE-2026-335608.8The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated CVE-2026-335653.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-335665.1There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the
CVE-2026-33550: Low severity, CVSS 2.6 | Vulnix