PT-2026-60094

Summary Two-factor authentication TOTP can be fully bypassed for the REST API. The KIMAI SESSION cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every /api/ endpoint. So after submittin...

SIP Sustainable Irrigation Platform 5.x (cli_control) Remote Code Execution

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

PT-2026-58856

Name of the Vulnerable Software and Affected Versions VMware Avi Load Balancer versions 31.1.1 through 31.2.2 VMware Avi Load Balancer versions 30.1.1 through 30.2.6 VMware Avi Load Balancer versions 22.1.1 through 22.1.7 Description An authentication bypass exists in the Avi Controller control...

PT-2026-58865

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite NCS, Manage Control Plan MCP, and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate...

PT-2026-58763

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data...

PT-2026-63408

Name of the Vulnerable Software and Affected Versions Check Point SmartConsole affected versions not specified Description An authentication bypass in the login process allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative...

PT-2026-63410

Name of the Vulnerable Software and Affected Versions Check Point Security Management affected versions not specified Multi-Domain Security Management affected versions not specified Description An authentication bypass allows an unauthenticated remote attacker to execute administrative commands ...

RHEL 10 : nodejs22 (RHSA-2026:39246)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39246 advisory. Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an...

UBUNTU-CVE-2026-47303

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

CVE-2026-62144 - Management Authentication Bypass and Privilege Escalation

Symptoms - Impact: An unauthenticated attacker can run any command on the Management including run-script and exec-command on Security Gateway Check Point Firewall. - Affected Products and versions: Products: Security Management, Multi-Domain Security Management Server MDS Product Versions: R77.3...

PT-2026-60889

Name of the Vulnerable Software and Affected Versions Schneider Electric EcoStruxure Cybersecurity Admin Expert affected versions not specified Description Insufficient protection of stored credentials within the application allows a local privileged attacker to bypass authentication and perform...

PT-2026-58071

Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth apple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id token against Apple's JWKS but does not validate any registered...

PT-2026-58006

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.1.13757 JetBrains YouTrack versions prior to 2025.3.148033 JetBrains YouTrack versions prior to 2025.2.148048 JetBrains YouTrack versions prior to 2025.1.148120 JetBrains YouTrack versions prior to...

CVE-2026-62422: Missing Authentication for Critical Function

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible...

CVE-2026-62644: Authentication Bypass by Spoofing

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover...

PT-2026-58004

Name of the Vulnerable Software and Affected Versions Opcenter X versions prior to V2604 Description An issue exists where the application fails to properly validate the algorithm specified in the JSON Web Token JWT header. This flaw allows an unauthenticated remote attacker to forge arbitrary...

PT-2026-58697

Name of the Vulnerable Software and Affected Versions ASP.NET Core affected versions not specified Description An authentication bypass occurs due to the use of assumed-immutable data, which allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there i...

PT-2026-58045

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Weak authentication in the JWT token validation pipeline allows an unauthenticated remote attacker to bypass security features over a network. Successful exploitation...

Siemens Opcenter X

SUMMARY Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application. Siemens has released a new version for Opcenter X and recommends to update to the latest version. 2. GENERAL RECOMMENDATIONS As a...

CVE-2026-62200 OpenClaw < 2026.6.6 Authentication Bypass via Git ext transport

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended...