PT-2026-70975

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by...

RHEL 9 : iscsi-initiator-utils (RHSA-2026:53844)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:53844 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as th...

AlmaLinux 9 : iscsi-initiator-utils (ALSA-2026:53844)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:53844 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

AlmaLinux 10 : iscsi-initiator-utils (ALSA-2026:53845)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:53845 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

PT-2026-71192

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can bypass security restrictions due to improper neutralization of special elements in an SQL parameter. This issue occurs when the system fails to correctly sanitize...

PT-2026-71102

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions can access private NuGet metadata under specific conditions. Recommendations At the moment, there is ...

PT-2026-71077

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

PT-2026-71064

Name of the Vulnerable Software and Affected Versions FortiManager version 7.6.1 FortiManager versions 7.4.3 through 7.4.5 FortiManager versions 7.2.5 through 7.2.9 FortiManager Cloud version 7.6.1 FortiManager Cloud versions 7.4.3 through 7.4.5 FortiManager Cloud versions 7.2.5 through 7.2.9...

PT-2026-71304

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

PT-2026-71094

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

RockyLinux 9 : iscsi-initiator-utils (RLSA-2026:53844)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:53844 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities

Summary The IBM Db2 Mirror for i GUI is affected by multiple vulnerabilities CVE-2026-17186, CVE-2026-17184, CVE-2026-17182, CVE-2026-17181, CVE-2026-16879, CVE-2026-17179, CVE-2026-16915, CVE-2026-17175, CVE-2026-18554, CVE-2026-17079, CVE-2026-16905, CVE-2026-17227, CVE-2026-17209,...

CVE-2026-68067

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and...

CVE-2026-67558

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...

CVE-2026-66340

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...

CVE-2026-66098

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...

CVE-2026-18710

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...

open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket

A flaw was found in open-iscsi. An incorrect authorization vulnerability allows unprivileged local users to bypass authentication for the iscsiuio control socket. This enables unauthorized access to the control socket, potentially leading to system compromise or disruption of iSCSI Internet Small...

Important: Red Hat Security Advisory: iscsi-initiator-utils security, bug fix, and enhancement update

An update for iscsi-initiator-utils is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-66875 Mira Hormone Monitor, Mira Android App Missing authentication for critical function

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range approximately 10–30 meters can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via...