PT-2026-83117

Name of the Vulnerable Software and Affected Versions PaperCut MF affected versions not specified PaperCut NG affected versions not specified Description An improper access control issue exists in the web management interface. Under specific conditions, unauthenticated remote requests targeting...

PT-2026-83118

Name of the Vulnerable Software and Affected Versions PaperCut MF affected versions not specified PaperCut NG affected versions not specified Description An unsafe dynamic class loading issue exists in the database connection utilities. The application instantiates database driver classes based o...

VulnCheck KEV: CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

RHEL 9 : iscsi-initiator-utils (RHSA-2026:60428)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60428 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as th...

Important: Red Hat Security Advisory: iscsi-initiator-utils security update

An update for iscsi-initiator-utils is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket

A flaw was found in open-iscsi. An incorrect authorization vulnerability allows unprivileged local users to bypass authentication for the iscsiuio control socket. This enables unauthorized access to the control socket, potentially leading to system compromise or disruption of iSCSI Internet Small...

CVE-2026-77298 SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not...

CVE-2026-77298 SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not...

CVE-2026-77298

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier , the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy . While the standard STS AssumeRoleWithWebIdentity ...

CVE-2026-61790

Weblate is a web-based continuous localization platform. In versions prior to 2026.7 , a team can enforce a two-factor authentication (2FA) requirement for its members, but this requirement is not applied to site-wide global permissions — only to project-, component-, and workspace-scoped permiss...

CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-75601

Static Web Server (SWS) versions through 2.43.0 contain an authentication bypass when both the basic-auth and metrics features are enabled. The /metrics endpoint is processed before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics ...

CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-75325

DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...

CVE-2026-73501

A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

CVE-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

EUVD-2026-66426

Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk: before 3.5.5...

CVE-2026-15985

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

EUVD-2026-66410

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...