PT-2026-116150

Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin...

PT-2026-116103

LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys...

PT-2026-115847

When Gitea's built-in SSH server is enabled START SSH SERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

PT-2026-116129

🛡️We added Fortinet path traversal vulnerability CVE-2026-61624 & BeyondTrust remote support authentication bypass vulnerability CVE-2026-102764 to our KEV Catalog. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org from cyberattacks. Cybersecurity InfoSec https://t.co/5hHRiyX6s...

PT-2026-116137

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication...

PT-2026-115975

Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network...

PT-2026-115978

Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network...

UBUNTU-CVE-2026-102946

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 / 12.1 < Security 2026 Update 4 Multiple Vulnerabilities

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, 12.0, or 12.1 and is missing the Security 2026 Update 4 Patch. It is, therefore, affected by multiple vulnerabilities: - A missing authentication vulnerability exists in Esri Portal for ArcGIS that allows a...

Linux Distros Unpatched Vulnerability : CVE-2026-77711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly...

Apache CXF < 3.6.13 / 4.x < 4.1.9 / 4.2.x < 4.2.4 Multiple Vulnerabilities

The version of Apache CXF installed on the remote host is prior to 3.6.13, or 4.x prior to 4.1.9, or 4.2.x prior to 4.2.4. It is, therefore, affected by multiple vulnerabilities, including: - The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a...

HPE iLO 5 < 3.22 / iLO 6 < 1.79 / iLO 7 < 1.25.01 Multiple Vulnerabilities (HPESBHF05170)

The version of HPE Integrated Lights-Out iLO firmware on the remote host is iLO 5 prior to 3.22, iLO 6 prior to 1.79, or iLO 7 prior to 1.25.01. It is, therefore, affected by multiple vulnerabilities as referenced in the HPESBHF05170 advisory. A remote attacker can exploit these vulnerabilities t...

Progress MOVEit Transfer < 2025.1.6 / 2026.0.x < 2026.0.4 Multiple Vulnerabilities (September 2026)

The version of Progress MOVEit Transfer installed on the remote host is prior to 2025.1.6 or 2026.0.x prior to 2026.0.4. It is, therefore, affected by multiple vulnerabilities, including: - Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer...

MiracleLinux 9 : curl-7.76.1-40.el9_8.8 (AXSA:2026-2080:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2080:08 advisory. curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure via incorrect Digest...

Exch-CVE-2021-26855

Exch-CVE-2021-26855 ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability...

CVE-2025-8730

CVE-2025-8730 – Authentication Bypass in Belkin F9K1009/F9K1010 Author : Byte Reaper Description : This repository contains a exploit for CVE‑2025‑8730, a critical Authentication Bypass vulnerability affecting the web interface of Belkin F9K1009 and F9K1010 routers. The flaw lies in the session...

CVE-2023-50564

CVE-2023-50564 How to use First setup a listener for the reverse shell. Terminal 1 nc -nlvp Execute the script which will attempt to install a pluck module sending the reverse shell back to us. Terminal 2 go run exploit.go -url -password -i -p...

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend TL;DR Yo, in this LetsDefend lab I dove into a SharePoint zero-day called ToolShell CVE-2025-53770. Basically, I mimicked a real-world attack where a malicious POST request bypassed auth, ran PowerShell to steal MachineKeySection keys,...

CVE-2026-89057

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access...

CVE-2026-89057

A potential authentication bypass vulnerability exists in certain Lenovo tablets , characterized by CWE-288 . This flaw could allow an attacker with physical access to the device to gain unauthorized access . The vulnerability is rated with a CVSS 4.0 base score of 7.0 (High) . No specific softwa...