PT-2026-71167

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...

PT-2026-71159

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can bypass security restrictions because the system does not properly validate session tokens. A session token is a unique identifier used by a server to recognize a...

FGFM Authentication Weakening via CLI Configuration

...

PT-2026-71303

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

PT-2026-71113

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description An unauthenticated user may bypass authentication under specific cache conditions. Recommendations At the moment, there is no information about a newer version that contains a fix f...

PT-2026-71143

Name of the Vulnerable Software and Affected Versions Semaphore UI versions prior to 2.18.21 Description The application lacks Cross-Site Request Forgery CSRF protection—a type of attack that tricks a victim into submitting a malicious request—and does not require current-password confirmation at...

AlmaLinux 10 : iscsi-initiator-utils (ALSA-2026:53845)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:53845 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

RHEL 9 : iscsi-initiator-utils (RHSA-2026:53844)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:53844 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as th...

AlmaLinux 9 : iscsi-initiator-utils (ALSA-2026:53844)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:53844 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

RockyLinux 10 : iscsi-initiator-utils (RLSA-2026:53845)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:53845 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

Apache Tomcat 11.0.23 RewriteValve Authentication Bypass

A proof of concept exploit for an authentication bypass vulnerability in Apache Tomcat version 11.0.23. The vulnerability exists because RewriteValve rebuilds decoded request URIs using java.net.URLDecoder, causing literal plus characters to be interpreted differently during security constraint...

PT-2026-71102

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions can access private NuGet metadata under specific conditions. Recommendations At the moment, there is ...

PT-2026-71248

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An authentication bypass exists in the FilterViewByPublishAccess filter. The system fails to verify publish password protection when rendering attribute views and database rows. This allows...

PT-2026-71192

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can bypass security restrictions due to improper neutralization of special elements in an SQL parameter. This issue occurs when the system fails to correctly sanitize...

PT-2026-71064

Name of the Vulnerable Software and Affected Versions FortiManager version 7.6.1 FortiManager versions 7.4.3 through 7.4.5 FortiManager versions 7.2.5 through 7.2.9 FortiManager Cloud version 7.6.1 FortiManager Cloud versions 7.4.3 through 7.4.5 FortiManager Cloud versions 7.2.5 through 7.2.9...

PT-2026-71077

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

RockyLinux 9 : iscsi-initiator-utils (RLSA-2026:53844)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:53844 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket

A flaw was found in open-iscsi. An incorrect authorization vulnerability allows unprivileged local users to bypass authentication for the iscsiuio control socket. This enables unauthorized access to the control socket, potentially leading to system compromise or disruption of iSCSI Internet Small...

Important: Red Hat Security Advisory: iscsi-initiator-utils security, bug fix, and enhancement update

An update for iscsi-initiator-utils is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-67558 Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...