PT-2026-114270

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OpenID connect handler allows a user's password to be accepted without requiring enrolled TOTP Time-based One-Time Password or WebAuthn verification before completing the sign-in process an...

PT-2026-113609

Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.8.1 Description An authentication bypass exists due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens. The 8-byte CTR nonce is stored within the ciphertext blob, and...

CVE-2026-110631: Initialization of a Resource with an Insecure Default

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty corepublickeys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to...

CVE-2026-100169: Improper Authentication

Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.presociallogin in...

PT-2026-113807

Name of the Vulnerable Software and Affected Versions Junos OS affected versions not specified Junos OS Evolved affected versions not specified Description An improper authentication issue exists in the J-Web management interface and NETCONF session handling. This flaw allows an unauthenticated...

PT-2026-114352

Name of the Vulnerable Software and Affected Versions F5 NGINX Kubernetes Ingress Controller versions 5.5.0 through 5.6.x Description An authentication and authorization bypass exists when the system is configured with the ExternalAuth policy or Ingress external authentication. The controller...

PT-2026-113614

The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width and height' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with...

PT-2026-113809

Name of the Vulnerable Software and Affected Versions Junos OS affected versions not specified Description An improper authentication issue in the J-Web web management component allows an unauthenticated remote attacker to execute arbitrary shell commands with root privileges via the exposed J-We...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer1-plugins-base (UTSA-2026-130054)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130054 advisory. A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header tha...

Linux Distros Unpatched Vulnerability : CVE-2026-78357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. A...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130100 advisory. Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication formerly JASPICServerAuthContext component...

Keycloak SingleUseObjectProvider Privilege Escalation

The vulnerability of the SingleUseObjectProvider component in the software for managing identities and access to Keycloak is related to improper isolation of the global storage. Exploiting this vulnerability could allow a malicious actor to enhance their privileges by manipulating authentication...

Omnibox address bars compromise Data Compromise

The vulnerability of the Omnibox address bars in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information through a specially created HTML page...

Active Directory Domain Services Code Execution

The vulnerability of Active Directory Domain Services for Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Google Chrome Microsoft Edge Information Disclosure

The vulnerability of the FileSystem component in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Web Authentication Passkeys Security Keys Access

The vulnerability of the Web Authentication components Passkeys & Security Keys in Google Chrome and Microsoft Edge is related to improper authorization. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

Password Component Access Information Disclosure

The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to authentication errors. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

TabGroups Component Google Chrome Microsoft Edge Information Disclosure

The vulnerability of the TabGroups component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information remotely...

Web Authentication Components Compromise Data Compromise

The vulnerability of the Web Authentication components Passkeys & Security Keys in Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected...

Loader Component Protected Information Access

The vulnerability of the Loader component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...