CVE-2026-110631: Initialization of a Resource with an Insecure Default

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty corepublickeys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to...

CVE-2026-89077: Incorrect Implementation of Authentication Algorithm

Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer SFTP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89070: Authentication Bypass by Capture-replay

Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer OIDC module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

Linux Distros Unpatched Vulnerability : CVE-2026-93582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER...

Keycloak SingleUseObjectProvider Privilege Escalation

The vulnerability of the SingleUseObjectProvider component in the software for managing identities and access to Keycloak is related to improper isolation of the global storage. Exploiting this vulnerability could allow a malicious actor to enhance their privileges by manipulating authentication...

Linux Distros Unpatched Vulnerability : CVE-2026-70175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. CVE-2026-70175 Note that Nessus relies on the...

Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm (CVE-2026-21718)

An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system. This plugin only works with Tenable.ot. Please visit...

Ivanti Connect Secure 22.8R2.x < 22.8R2.5 / 25.1.0.x / 25.1.1.x < 25.1.1.2 / 25.1.2.x < 25.1.3.0 Authentication Bypass (CVE-2026-104935)

The Ivanti Connect Secure install on the remote host is 22.8R2.x prior to 22.8R2.5, 25.1.0.x or 25.1.1.x prior to 25.1.1.2, or 25.1.2.x prior to 25.1.3.0. It is, therefore, affected by an authentication bypass by spoofing vulnerability: - An authentication bypass by spoofing in Ivanti Connect...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130102)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130102 advisory. Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from...

Linux Distros Unpatched Vulnerability : CVE-2026-78357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. A...

CVE-2026-110616: Missing Authentication for Critical Function

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ management API because the authtoken field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback...

CVE-2026-89067: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-113705

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create wp user for customer helper reached from the public process step customer booking...

PT-2026-113809

Name of the Vulnerable Software and Affected Versions Junos OS affected versions not specified Description An improper authentication issue in the J-Web web management component allows an unauthenticated remote attacker to execute arbitrary shell commands with root privileges via the exposed J-We...

CVE-2026-89068: Missing Critical Step in Authentication

Missing critical step in authentication vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-55167: Authentication Bypass by Capture-replay

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...

PT-2026-114190

Name of the Vulnerable Software and Affected Versions TR7 ASP versions 1.0.40.236 through 1.0.1554.2330 TR7 ASP versions 1.6.42.239 through 1.6.1554.2330 Description Missing authentication for a critical function in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances allows for...

PT-2026-114252

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.21.0 Description FileRise fails to consistently enforce authentication restrictions on the server side. While the client interface respects the disableFormLogin, disableBasicAuth, and disableOIDCLogin settings, the...

CVE-2026-103977: Improper Restriction of Excessive Authentication Attempts

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a...

PT-2026-113838

🚨 CVE-2026-101986 An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request. 🎖@cveNotify...