PT-2026-116089

Name of the Vulnerable Software and Affected Versions Simple Admin Core versions prior to 1.8.8 Description An authentication bypass exists due to a hard-coded Auth.AccessSecret located in the api/etc/core.yaml file. This allows unauthenticated remote attackers to forge JSON Web Tokens JWT by...

MiracleLinux 9 : curl-7.76.1-40.el9_8.8 (AXSA:2026-2080:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2080:08 advisory. curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure via incorrect Digest...

Apache CXF < 3.6.13 / 4.x < 4.1.9 / 4.2.x < 4.2.4 Multiple Vulnerabilities

The version of Apache CXF installed on the remote host is prior to 3.6.13, or 4.x prior to 4.1.9, or 4.2.x prior to 4.2.4. It is, therefore, affected by multiple vulnerabilities, including: - The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 / 12.1 < Security 2026 Update 4 Multiple Vulnerabilities

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, 12.0, or 12.1 and is missing the Security 2026 Update 4 Patch. It is, therefore, affected by multiple vulnerabilities: - A missing authentication vulnerability exists in Esri Portal for ArcGIS that allows a...

CVE-2026-110924

A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...

PT-2026-115603

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 5 through 5.0.4 Description An issue involving missing authentication for critical functions and improper neutralization of special elements used in SQL commands allows for SQL Injection. This occurs when certain backend...

UBUNTU-CVE-2026-110924

A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...

Nginx UI MCP Component Data Compromise

The vulnerabilities of the nginxconfigadd and nginxconfigmodify functions of the MCP component of the Nginx UI server involve bypassing authentication procedures by using an alternative path or channel. Exploiting these vulnerabilities allows a malicious actor to compromise the integrity and...

PT-2026-116040

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...

PT-2026-116043

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get current user dependency. Attackers can read audit logs with login IPs, serve...

PT-2026-116025

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or...

PT-2026-116042

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter...

PT-2026-116052

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS SAAS is true, attackers can enumerate sequential...

PT-2026-116105

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing...

PT-2026-116036

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

PT-2026-116107

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

PT-2026-116129

🛡️We added Fortinet path traversal vulnerability CVE-2026-61624 & BeyondTrust remote support authentication bypass vulnerability CVE-2026-102764 to our KEV Catalog. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org from cyberattacks. Cybersecurity InfoSec https://t.co/5hHRiyX6s...

PT-2026-115978

Name of the Vulnerable Software and Affected Versions Microsoft Identity Web affected versions not specified Description An authentication bypass exists due to the use of assumed-immutable data, which allows an authorized attacker to elevate privileges over a network. Recommendations At the momen...

PT-2026-115975

Name of the Vulnerable Software and Affected Versions Microsoft Authentication Library MSAL for Node.js affected versions not specified Description An origin validation error allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no...

UBUNTU-CVE-2026-100351

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...