Astra Linux – Vulnerability in curl

A authentication bypass vulnerability exists in libcurl prior to v8.0.0. It reuses an previously established SSH connection, even though one SSH option has been modified, which should prevent such reuse. libcurl maintains a pool of previously used connections and can reuse them for subsequent...

Exploit for CVE-2026-31337

Patch: CVE-2026-31337 Vulnerability Details - CVE: CVE...

The vulnerability of the Parser component in web browsers Firefox and Firefox ESR, as well as in the Thunderbird email client, allows a hacker to trigger a service failure.

The vulnerability of the Parser component in Firefox and Firefox ESR web browsers, as well as in the Thunderbird email client, relates to bypassing authentication by using an alternative path or channel. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

The vulnerability in the Networking component of Firefox and Firefox ESR web browsers, as well as the Thunderbird email client, allows a hacker to induce a service failure.

The vulnerability in the Networking component of Firefox and Firefox ESR web browsers, as well as the Thunderbird email client, relates to bypassing authentication by using an alternative path or channel. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

The vulnerability of the Security component in web browsers Firefox ESR, Firefox, and the email client Thunderbird allows a hacker to trigger a service failure.

The vulnerability of the Security component in Firefox ESR, Firefox, and the Thunderbird email client involves bypassing authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to cause service interruptions...

PT-2026-80866

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector affected versions not specified Description An authentication bypass issue exists in the communications between the Zscaler Client Connector and the Zscaler Client Connector Portal. Authentication bypass occurs when an...

The vulnerability in the Firefox web browser, related to bypassing authentication through spoofing, allows attackers to compromise data integrity.

The vulnerability in the Firefox web browser relates to bypassing authentication through spoofing. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

PT-2026-80923

Name of the Vulnerable Software and Affected Versions rConfig versions 8.0.0 through 8.2.12 Description An authentication bypass exists due to a duplicate Auth::routes call in the routes/web.php file, which inadvertently re-enables the POST /register endpoint after it had been disabled. This allo...

PT-2026-81053

Name of the Vulnerable Software and Affected Versions CakePHP Authentication versions prior to 2.11.2 CakePHP Authentication versions 3.0.0 through 3.3.6 CakePHP Authentication versions 4.0.0 through 4.2.0 Description An authentication bypass and potential CPU or memory exhaustion can occur when...

PT-2026-80858

Name of the Vulnerable Software and Affected Versions miniOrange OAuth Client versions prior to 3.2.0 Description An issue in the miniOrange OAuth Client extension for Joomla allows an attacker to log in as any account, including administrators, without requiring a valid account or prior...

PT-2026-80888

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.2 Description An authentication bypass exists in the REST API due to an insecure object cache keying mechanism. The cache uses only the lookup value as a key and fails to include the searched column. This allows a...

CVE-2026-19565

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

CVE-2026-19565 Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

EUVD-2026-64663

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

CVE-2026-19565

Apache::AppSamurai::Util (Perl, versions through 1.01 ) generates predictable session authentication keys in CreateSessionAuthKey by hashing five successive Time::HiRes microsecond readings together with the process ID via SHA-256. Because the microsecond field yields only ~1 million values, subs...

PT-2026-79780

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

Security Bulletin: MaaS360 mobile apps (iOS and Android) are able to bypass authentication by using deep link from the browser.

Summary MaaS360 mobile apps iOS and Android are able to bypass authentication by using deep link from the browser. Vulnerability Details CVEID:CVE-2023-42021 DESCRIPTION: The MaaS360 iOS application could allow an attacker to bypass authentication mechanisms by exploiting the password reset...

CVE-2026-59808

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

CVE-2026-62382 PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against currentuser; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes...

CVE-2026-62382 PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against currentuser; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes...