CVE-2026-100169: Improper Authentication

Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.presociallogin in...

CVE-2026-93635: Improper Neutralization of Special Elements used in an LDAP Query

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...

CVE-2026-73535: Missing Critical Step in Authentication

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an...

Ahsay AhsayCBS Improper Authentication Vulnerability

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134...

PT-2026-114287

Name of the Vulnerable Software and Affected Versions KEDA versions prior to 2.21.0 Description A namespace administrator can exploit a flaw by creating TriggerAuthentication and ScaledObject resources, setting the hashiCorpVault.address to a tenant-controlled endpoint and selecting Kubernetes...

PT-2026-113741

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description When using an ambient user during an initial transfer with Negotiate authentication, curl may incorrectly transmit credential details to an unrelated second origin if it is instructed to follow...

PT-2026-113807

Name of the Vulnerable Software and Affected Versions Junos OS affected versions not specified Junos OS Evolved affected versions not specified Description An improper authentication issue exists in the J-Web management interface and NETCONF session handling. This flaw allows an unauthenticated...

Ivanti Connect Secure 22.8R2.x < 22.8R2.5 / 25.1.0.x / 25.1.1.x < 25.1.1.2 / 25.1.2.x < 25.1.3.0 Authentication Bypass (CVE-2026-104935)

The Ivanti Connect Secure install on the remote host is 22.8R2.x prior to 22.8R2.5, 25.1.0.x or 25.1.1.x prior to 25.1.1.2, or 25.1.2.x prior to 25.1.3.0. It is, therefore, affected by an authentication bypass by spoofing vulnerability: - An authentication bypass by spoofing in Ivanti Connect...

PT-2026-114425

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description When processing an HTTP redirect to a URL containing userinfo a username:password component, curl may incorrectly retain and re-transmit the HTTP Negotiate authentication state from the original...

PT-2026-114360

Three critical authentication bypass flaws in Bisheng open-source LLM DevOps platform allow unauthenticated attackers to gain full admin control and expose cross-user data. Technical Breakdown: - CVE-2026-96679 Legacy SSO Bypass: The POST /user/sso endpoint accepts arbitrary usernames in JSON...

CVE-2026-109969: Missing Authentication for Critical Function

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...

Network Device Enrollment Service Code Execution

The vulnerability of the Network Device Enrollment Service NDES for Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-104108: Improper Authentication

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferredusername or email claims and does not require emailverified for email-based naming. An...

Active Directory Domain Services Code Execution

The vulnerability of Active Directory Domain Services for Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-113609

Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.8.1 Description An authentication bypass exists due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens. The 8-byte CTR nonce is stored within the ciphertext blob, and...

PT-2026-114352

Name of the Vulnerable Software and Affected Versions F5 NGINX Kubernetes Ingress Controller versions 5.5.0 through 5.6.x Description An authentication and authorization bypass exists when the system is configured with the ExternalAuth policy or Ingress external authentication. The controller...

PT-2026-114073

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core public keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to...

Google Chrome Microsoft Edge Information Disclosure

The vulnerability of the DOM components in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Transactions Platform XSS

The vulnerability of the Transactions Platform web browsers Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Google Chrome Edge FileSystem Data Compromise

The vulnerability of the FileSystem component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability allows a remote attacker to compromise the integrity of protected information through a specially created HTML page...