PT-2026-105184

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

PT-2026-105584

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth...

AlmaLinux 9.2 [TuxCare] Security Update: kbd / kbd-legacy / kbd-misc (ALMALINUX9.2:CLSA-2026:1788600455)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788600455 advisory. - openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the...

Rocky Linux 8 [CIQ] Security Update: irssi / irssi-debuginfo / irssi-debugsource / irssi-devel (crlsa-2020_1616)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20201616 advisory. irssi: use after free when sending SASL login to server CVE-2019-13045 Tenable has extracted the preceding description block directly from the CIQ security advisory...

CVE-2026-87004

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/authoidcprovider.py decodes the idtoken returned by the identity provider's token endpoint using jose.jwt.getunverifiedclaims...

CVE-2026-55181

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

CVE-2026-55181

Prior to version 1.30.3 , Tugtainer (a self-hosted app for automating Docker container updates) contains a vulnerability where OIDC authentication can be initiated even when OIDC_ENABLED=false. While the /auth/oidc/enabled endpoint correctly reports that OIDC is disabled, a direct request to /aut...

EUVD-2026-90192

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

USN-8858-1: Authen::SASL vulnerability

It was discovered that Authen::SASL, a Perl authentication library, did not properly validate login attempts. An attacker could possibly use this issue to gain unauthorized access...

OESA-2026-4164 python-jupyter-server security update

The backend for Jupyter web applications Security Fixes: Jupyter Server is the backend for Jupyter web applications. In jupyterserver versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler.redirectsafe, which allows redirects to arbitra...

CVE-2026-94081

Unauthenticated Cross Site Scripting XSS in WordPress Persistent Login = 3.1.3 versions...

CVE-2026-94081 WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WordPress Persistent Login = 3.1.3 versions...

EUVD-2026-89834

Unauthenticated Cross Site Scripting XSS in WordPress Persistent Login = 3.1.3 versions...

CVE-2026-94081 WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WordPress Persistent Login = 3.1.3 versions...

CVE-2026-94081

The WordPress Persistent Login plugin versions

CVE-2026-74865 Authentication Bypass in sogo_yhn

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin WordPress Persistent Login versions = 3.1.3...