Password Component Access Information Disclosure

The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to authentication errors. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

WebProtect Components Protected Information Access

The vulnerability of the WebProtect components for Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Editing Component Protected Information Access

The vulnerability of the Editing component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Netcore NR268 CGI User Ok Data Compromise

The vulnerability of the userok function in the CGI interface of Netcore NR268 microprogramming systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

Network Device Enrollment Service Code Execution

The vulnerability of the Network Device Enrollment Service NDES for Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer1-plugins-base (UTSA-2026-130054)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130054 advisory. A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header tha...

Linux Distros Unpatched Vulnerability : CVE-2026-109949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the...

AlmaLinux 8 : nodejs:24 (ALSA-2026:74085)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:74085 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value (CVE-2026-25085)

A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass. This plugin only works with Tenable.ot. Please visit...

PT-2026-113989

Name of the Vulnerable Software and Affected Versions PgBouncer versions 1.17.0 through 1.26.0 Description Improper authentication occurs during the SCRAM authentication process. A remote attacker who possesses the password of a user listed in the auth file can authenticate as any other user that...

WebXR Interfaces Access Protected Information

The vulnerability of the WebXR interfaces of Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

ServiceWorker Access Information Disclosure

The vulnerability of the ServiceWorker interface in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow a remote attacker to gain access to protected information...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130100 advisory. Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication formerly JASPICServerAuthContext component...

Linux Distros Unpatched Vulnerability : CVE-2026-70175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. CVE-2026-70175 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2026-70179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-70179 Note that Nessus relies on...

PT-2026-114270

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OpenID connect handler allows a user's password to be accepted without requiring enrolled TOTP Time-based One-Time Password or WebAuthn verification before completing the sign-in process an...

Ahsay AhsayCBS Improper Authentication Vulnerability

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134...

VulnCheck KEV: CVE-2025-41450

Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2...

CVE-2026-89070: Authentication Bypass by Capture-replay

Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer OIDC module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-114322

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An authentication bypass exists in the OIDC module due to a capture-replay flaw. Approximately 1,700 instances have been identified...