These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-108163 is a medium-severity vulnerability in Pingvin Share X before version 1.22.0, caused by an ineffective rate limiting mechanism due to incorrect interpretation of throttler TTL values. This allows unauthenticated attackers to send effectively unthrottled requests to certain authentication endpoints, potentially leading to brute-force attacks on passwords and TOTP codes.
CVE-2026-108162 is a rate limit bypass vulnerability in Pingvin Share X before 1.22.0 that allows unauthenticated remote attackers to evade per-IP throttling. The vulnerability exists because backend/src/main.ts unconditionally trusts proxy headers. Attackers can exploit this vulnerability by rotating spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPasswo [truncated]
A vulnerability in Pingvin Share X versions 1.5.0 through 1.18.0 allows an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings due to a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. This issue arises because an unawaited `Promise` in JavaScript is [truncated]