WebProtect Components Protected Information Access

The vulnerability of the WebProtect components for Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

TabStrip Component DoS

The vulnerability of the TabStrip component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Password Component Access Information Disclosure

The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to authentication errors. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Web Authentication Components Compromise Data Compromise

The vulnerability of the Web Authentication components Passkeys & Security Keys in Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected...

Keycloak SingleUseObjectProvider Privilege Escalation

The vulnerability of the SingleUseObjectProvider component in the software for managing identities and access to Keycloak is related to improper isolation of the global storage. Exploiting this vulnerability could allow a malicious actor to enhance their privileges by manipulating authentication...

Netcore NR268 CGI User Ok Data Compromise

The vulnerability of the userok function in the CGI interface of Netcore NR268 microprogramming systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

Editing Component Protected Information Access

The vulnerability of the Editing component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Network Device Enrollment Service Code Execution

The vulnerability of the Network Device Enrollment Service NDES for Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Omnibox address bars compromise Data Compromise

The vulnerability of the Omnibox address bars in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information through a specially created HTML page...

mpfddecode function in the Data Compromise

The vulnerability of the mpfddecode function in the bootloaderregion.bin file of the Emergency HTTP Recovery Server component of the D-Link DCS-930L Wi-Fi camera software is related to insufficient data authentication checks. Exploiting this vulnerability could allow an attacker to compromise the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130123)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130123 advisory. Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through...

PT-2026-113809

Name of the Vulnerable Software and Affected Versions Junos OS affected versions not specified Description An improper authentication issue in the J-Web web management component allows an unauthenticated remote attacker to execute arbitrary shell commands with root privileges via the exposed J-We...

Linux Distros Unpatched Vulnerability : CVE-2026-93582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER...

Rocky Linux 9 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (crlsa-2026_80511)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680511 advisory. curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure via incorrect Digest...

AlmaLinux 8 : nodejs:24 (ALSA-2026:74085)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:74085 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

Ivanti Connect Secure 22.8R2.x < 22.8R2.5 / 25.1.0.x / 25.1.1.x < 25.1.1.2 / 25.1.2.x < 25.1.3.0 Authentication Bypass (CVE-2026-104935)

The Ivanti Connect Secure install on the remote host is 22.8R2.x prior to 22.8R2.5, 25.1.0.x or 25.1.1.x prior to 25.1.1.2, or 25.1.2.x prior to 25.1.3.0. It is, therefore, affected by an authentication bypass by spoofing vulnerability: - An authentication bypass by spoofing in Ivanti Connect...

SonicWALL Global Management System (GMS) < 9.4 Multiple Vulnerabilities (SNWLID-2024-0007)

The version of SonicWALL Global Management System GMS running on the remote host is prior to 9.4. It is, therefore, affected by multiple vulnerabilities: - The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity XXE injection, potentially resulting in the...

PT-2026-113741

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description When using an ambient user during an initial transfer with Negotiate authentication, curl may incorrectly transmit credential details to an unrelated second origin if it is instructed to follow...

PT-2026-114425

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description When processing an HTTP redirect to a URL containing userinfo a username:password component, curl may incorrectly retain and re-transmit the HTTP Negotiate authentication state from the original...

CVE-2026-77207

Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERTPKCS7WRAPPEDX509, it guards the PKCS7 blob with SECPKCS7ContainsCertsOrCrls and then iterates the certificate list with...