Microsoft Windows: CVE-2026-85328: Windows Projected File System Elevation of Privilege Vulnerability

Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96183: Windows Health and Optimized Experiences Service Information Disclosure Vulnerability

Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally...

PT-2026-112716

Name of the Vulnerable Software and Affected Versions Network Device Enrollment Service NDES affected versions not specified Description Weak authentication in the Network Device Enrollment Service NDES allows an authorized attacker to perform spoofing over a network. Recommendations At the momen...

PT-2026-112719

Name of the Vulnerable Software and Affected Versions Windows Projected File System affected versions not specified Description Weak authentication in the Windows Projected File System allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no...

Microsoft Windows: CVE-2026-70235: Windows Event Tracing Spoofing Vulnerability

Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally...

PT-2026-113393

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 Description An authentication bypass flaw exists when the samlWeb-2.0 feature is enabled. This issue allows unauthenticated remote attackers to bypass enterprise...

VulnCheck KEV: CVE-2024-9893

The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.1.14. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as a...

PT-2026-111735

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...

Google Chrome Microsoft Edge Data Compromise

The vulnerability of Google Chrome and Microsoft Edge browsers is related to improper authentication procedures. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information through a specially crafted HTML page...

Microsoft Windows: CVE-2026-83906: Windows Shell Spoofing Vulnerability

Incorrect implementation of authentication algorithm in Windows Shell allows an unauthorized attacker to perform spoofing over a network...

PT-2026-112001

Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network...

PT-2026-112486

Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally...

CVE-2026-107605: Missing Authentication for Critical Function

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication...

CVE-2026-109750: Undefined Security Weakness

Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

PT-2026-111172

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.11 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description An issue exists in the Kubernetes proxy where improper redirect validation allows an authenticated user...

CVE-2026-89309: Missing Authentication for Critical Function

The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method...

PT-2026-111801

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 4.4.0 through 4.4.9 FortiSandbox versions 5.0.0 through 5.0.6 FortiSandbox PaaS versions 4.4.x and earlier FortiSandbox PaaS versions 5.0.0 through 5.0.6 Description Improper access control and session management in the w...

PT-2026-112140

Name of the Vulnerable Software and Affected Versions Active Directory Federation Services affected versions not specified Description Weak authentication allows an unauthorized attacker to bypass a security feature over a network, which can lead to an impact on the system. Recommendations At the...

PT-2026-112837

Name of the Vulnerable Software and Affected Versions Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 version 26H1 Windows 11 Version 26H2 Description Missing authentication for a critical function in the Windows Health and Optimized Experiences Service allows an authorized attacker to...

Microsoft Windows: CVE-2026-88158: Microsoft Digest Authentication Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally...