EUVD-2026-56044

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72601

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

CVE-2026-72601 CSZ CMS CSZ CMS - Broken Access Control

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

CVE-2026-72561

CVE-2026-72561 describes a broken access control in Peppermint Lab Peppermint. Through commit ba6e217, any authenticated non-administrative user can reconfigure the platform’s global OIDC/SSO settings via an unprotected configuration endpoint that performs no administrative role check before appl...

CVE-2026-72555

Peppermint Lab Peppermint is affected by a broken access control vulnerability (CVE-2026-72555) caused by the Config.roles_active flag defaulting to false, making all permission checks on ticket, client, and user handlers no-ops on default installations. As a result, all authenticated users can r...

SUSE-SU-2026:23064-1 Security update for pcp

This update for pcp fixes the following issues: - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. - CVE-2026-16527: missing...

EUVD-2026-56003

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

CVE-2026-72533 Portainer Portainer CE - Authentication Bypass

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

CVE-2026-72533 Portainer Portainer CE - Authentication Bypass

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

CVE-2026-72533

The CVE concerns Portainer CE (up to 2.44.0) with an authentication bypass in the Docker proxy path validation. Authenticated low-privilege users can bypass proxy authorization checks through non-canonical URL normalization, causing the proxy and authorization layer to interpret crafted requests ...

RHSA-2026:52929 Red Hat Security Advisory: postgresql-jdbc security update

Bulletin has no description...

RHSA-2026:52928 Red Hat Security Advisory: postgresql-jdbc security update

Bulletin has no description...

CVE-2026-15563

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

DEBIAN-CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

CVE-2026-15556

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...

CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

CVE-2026-15565

CVE-2026-15565 affects Undertow: a flaw enables a remote attacker to cause Out of Memory on a websockets endpoint without authentication for any @ServerEndpoint class that has an @OnMessage method, resulting in Denial of Service. The issue impacts the availability of the service (CVSS v3.1: AV:N/...

EUVD-2026-55987

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

CVE-2026-15563

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...