CVE-2026-77207

Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERTPKCS7WRAPPEDX509, it guards the PKCS7 blob with SECPKCS7ContainsCertsOrCrls and then iterates the certificate list with...

CVE-2026-77207

Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERTPKCS7WRAPPEDX509, it guards the PKCS7 blob with SECPKCS7ContainsCertsOrCrls and then iterates the certificate list with...

CVE-2026-77207

Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERTPKCS7WRAPPEDX509, it guards the PKCS7 blob with SECPKCS7ContainsCertsOrCrls and then iterates the certificate list with...

CVE-2026-77207

The Libreswan VPN software contains a null pointer dereference bug within the PKCS#7 handling code used for IKE certificate authentication. The vulnerability occurs when the software decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509 . Specifically, the system uses two NSS APIs that disa...

CVE-2026-93909

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled...

Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Authentication.Negotiate. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. ASP.NET Core...

CVE-2026-93909

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are vulnerable to an authentication bypass vulnerability when the samlWeb-2.0 feature is enabled. This issue is associated with CWE-384 (Session Fixation) and carries a CVSS 3.1 base score of 9.1 (CRITICAL) . The vulnera...

CVE-2026-93909 IBM WebSphere Application Server Liberty is affected by an authentication bypass

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled...

CVE-2026-63158

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAPLOG/AGORAPPASS cookie mechanism treating the...

CVE-2026-63160

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...

Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows,...

GHSA-2FMV-RV2C-59X7 Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows,...

Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. .NET 11 post-handshake TLS client...

GHSA-FQPQ-CX42-9JMM Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. .NET 11 post-handshake TLS client...

Security Bulletin: IBM i is Affected By An Improper Authentication Vulnerability in SST / DST [CVE-2026-17488]

Summary IBM i is vulnerable to bypassing security restrictions due to improper authentication CVE-2026-17488 in System Service Tools SST / Dedicated Service Tools DST as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17488 DESCRIPTION: IBM i could allow a...

CVE-2026-63160

The Omnispace Agora Project versions prior to 26.10.0 are vulnerable to insecure storage of persistent remember-me tokens . The software stores these tokens verbatim on the server-side, meaning the stored value is identical to the bearer credential held in the user's cookie. An attacker who gains...

CVE-2026-63160 Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...

CVE-2026-63158 Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAPLOG/AGORAPPASS cookie mechanism treating the...

CVE-2026-63158

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAPLOG/AGORAPPASS cookie mechanism treating the...

CVE-2026-63158

The Omnispace Agora Project (versions before 26.10.0 ) is vulnerable to an authentication bypass via a Pass-the-Hash attack. The root cause is the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism, which incorrectly treats stored bcrypt password hashes as replayable bearer credentials. An attacker w...