PT-2026-114073

Name of the Vulnerable Software and Affected Versions Komodo versions prior to 2.3.4 Description An authentication bypass exists in the Periphery agent. This occurs because empty core public keys and passkeys lists fail open by default, allowing unauthenticated attackers to connect as a trusted...

PT-2026-114207

Name of the Vulnerable Software and Affected Versions LDAP Account Manager LAM versions prior to 9.6 Description Installations using WebAuthn two-factor authentication fail to clear the challenge from the PHP session after the authentication response is processed. This allows a user who has alrea...

PT-2026-114190

Name of the Vulnerable Software and Affected Versions TR7 ASP versions 1.0.40.236 through 1.0.1554.2330 TR7 ASP versions 1.6.42.239 through 1.6.1554.2330 Description Missing authentication for a critical function in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances allows for...

Bisheng has authentication bypass vulnerabilities

Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on SSO endpoint; an Insecure Direct Object Reference IDOR vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perfor...

Ahsay AhsayCBS Improper Authentication Vulnerability

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134...

CVE-2026-93635: Improper Neutralization of Special Elements used in an LDAP Query

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...

CVE-2026-104108: Improper Authentication

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferredusername or email claims and does not require emailverified for email-based naming. An...

VulnCheck KEV: CVE-2025-41450

Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2...

CVE-2026-109969: Missing Authentication for Critical Function

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...

CVE-2026-55167: Authentication Bypass by Capture-replay

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...

PT-2026-113838

🚨 CVE-2026-101986 An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request. 🎖@cveNotify...

CVE-2026-89068: Missing Critical Step in Authentication

Missing critical step in authentication vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-114320

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An authentication bypass exists in the LDAP module due to a missing critical step in the authentication process. Approximately 1,700...

Extensions Component Protected Information Access

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

CVE-2026-89067: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-114058

Name of the Vulnerable Software and Affected Versions NullHub versions prior to 2026.5.29 Description An authentication bypass exists in the management API endpoint /api/ because the auth token field defaults to null and is never assigned. Unauthenticated attackers sending requests without...

CVE-2026-89070: Authentication Bypass by Capture-replay

Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer OIDC module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-114287

Name of the Vulnerable Software and Affected Versions KEDA versions prior to 2.21.0 Description A namespace administrator can exploit a flaw by creating TriggerAuthentication and ScaledObject resources, setting the hashiCorpVault.address to a tenant-controlled endpoint and selecting Kubernetes...

PT-2026-114252

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.21.0 Description FileRise fails to consistently enforce authentication restrictions on the server side. While the client interface respects the disableFormLogin, disableBasicAuth, and disableOIDCLogin settings, the...

CVE-2026-103977: Improper Restriction of Excessive Authentication Attempts

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a...