CVE-2026-89077: Incorrect Implementation of Authentication Algorithm

Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer SFTP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-114166

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.83 n8n versions prior to 2.41.4 n8n versions prior to 2.42.1 Description An authentication bypass exists due to dynamic-path webhook resolution matching requests based solely on the path, ignoring the server-generat...

CVE-2026-73535: Missing Critical Step in Authentication

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an...

PT-2026-114322

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An authentication bypass exists in the OIDC module due to a capture-replay flaw. Approximately 1,700 instances have been identified...

PT-2026-114288

Name of the Vulnerable Software and Affected Versions Talos Linux versions prior to 1.12.9 Talos Linux versions prior to 1.13.3 Description In talosctl support, the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml are includ...

PT-2026-114270

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OpenID connect handler allows a user's password to be accepted without requiring enrolled TOTP Time-based One-Time Password or WebAuthn verification before completing the sign-in process an...

PT-2026-113609

Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.8.1 Description An authentication bypass exists due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens. The 8-byte CTR nonce is stored within the ciphertext blob, and...

CVE-2026-110631: Initialization of a Resource with an Insecure Default

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty corepublickeys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to...

PT-2026-113809

Name of the Vulnerable Software and Affected Versions Junos OS affected versions not specified Description An improper authentication issue in the J-Web web management component allows an unauthenticated remote attacker to execute arbitrary shell commands with root privileges via the exposed J-We...

Keycloak SingleUseObjectProvider Privilege Escalation

The vulnerability of the SingleUseObjectProvider component in the software for managing identities and access to Keycloak is related to improper isolation of the global storage. Exploiting this vulnerability could allow a malicious actor to enhance their privileges by manipulating authentication...

Omnibox address bars compromise Data Compromise

The vulnerability of the Omnibox address bars in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information through a specially created HTML page...

Active Directory Domain Services Code Execution

The vulnerability of Active Directory Domain Services for Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Google Chrome Microsoft Edge Information Disclosure

The vulnerability of the FileSystem component in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Web Authentication Passkeys Security Keys Access

The vulnerability of the Web Authentication components Passkeys & Security Keys in Google Chrome and Microsoft Edge is related to improper authorization. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

Password Component Access Information Disclosure

The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to authentication errors. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

TabGroups Component Google Chrome Microsoft Edge Information Disclosure

The vulnerability of the TabGroups component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information remotely...

Loader Component Protected Information Access

The vulnerability of the Loader component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

WebProtect Components Protected Information Access

The vulnerability of the WebProtect components for Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

StorageAccessAPI Component Compromise

The vulnerability of the StorageAccessAPI component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information through a specially created HTML page...

Preload Component Access Information Disclosure

The vulnerability of the Preload component in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability can allow a remote attacker to gain access to protected information through a specially created HTML page...