CVE-2026-78103 Dimension Log Server Configuration Lock Bypass Vulnerability

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

CVE-2023-32315-java7-

CVE-2023-32315 0x01 Die zurückgegebene JSESSIONID und csrftoken abrufen und ein Anforderungspaket zum Hinzufügen eines Benutzers erstellen JSESSIONID und csrftoken ersetzen img.png root@kitploit: cd CVE-2023-32315-Openfire-Bypass/scanall go mod tidy go run main.go -u http://openfire.com:9090 0x02...

Security Bulletin: Security Vulnerability in Spring-Security affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22752)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring-Security Vulnerability Details CVEID:CVE-2026-22752 DESCRIPTION: Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects...

CVE-2026-76943 Xiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

CVE-2026-76943

CVE-2026-76943 affects the Xiiaozet LK100W (LK100Wt) device, which contains an authentication weakness in an administrative service that allows an attacker to bypass access controls and obtain command execution capabilities. Successful exploitation could lead to unauthorized interaction with priv...

CVE-2026-71187

Ebyte NE2-D11 contains a vulnerability in its client-side authentication logic that unauthenticated users can reproduce, allowing an attacker to generate valid authentication requests and bypass authentication entirely to obtain administrative access to the device. The flaw is assessed CRITICAL (...

CVE-2026-71187 Ebyte NA111-M Use of Client-Side Authentication

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

CVE-2026-71187 Ebyte NA111-M Use of Client-Side Authentication

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

CVE-2025-30156

CVE-2025-30156 affects the Ceph distributed storage platform in versions prior to 20.2.4 (Tentacle) and 19.2.6 . The CephX authentication protocol encrypts tickets with AES-128-CBC using a hard-coded IV and no message authentication, making it vulnerable to the same class of unauthenticated-encry...

CVE-2025-30156 Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

Security Bulletin: Security Vulnerability in Apache Shiro affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-23901, CVE-2026-23903)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Shiro Vulnerability Details CVEID:CVE-2026-23903 DESCRIPTION: Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users ar...

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

On August 19th, 2026, during internal research, I discovered an Authentication Bypass vulnerability in WPMU DEV Dashboard, a WordPress plugin with an estimated 350,000 active installations. This vulnerability makes it possible for unauthenticated attackers to gain administrator access when Hub...

CVE-2026-81826

Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that...

CVE-2026-81703

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

CVE-2026-81680

opensslencrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silent...

CVE-2026-81664

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/ handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added i...

CVE-2026-81703

openssl_encrypt versions before 1.4.9 fail to validate the encryption status of embedded post-quantum private keys in file metadata. An attacker can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext wit...

EUVD-2026-67059

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

CVE-2026-81703 openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

CVE-2026-81703 openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...