EUVD-2026-55929

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

GHSA-GM37-52C6-37MW vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-67422 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-59936 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-59937 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-66775

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

CVE-2026-66773

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

EUVD-2025-210673

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid...

EUVD-2025-210672

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

EUVD-2026-55887

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

CVE-2026-66775

CVE-2026-66775 affects SAP Approuter (SAP Business AI Platform). The vulnerability is a CSRF flaw where cross-site request forgery protection is not enforced on the authentication flow by default. An unauthenticated attacker could craft a malicious link to lure a victim and bind the victim’s sess...

EUVD-2026-55885

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

CVE-2026-66773 Server-controlled `__next` URL is not checking cross-origin

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

CVE-2026-66772

CVE-2026-66772 concerns SAP BusinessObjects BI Platform (Admin Tools), where a missing authorization check on certain administrative functionality lets an authenticated non-administrative user bypass restrictions to glean limited information about the affected feature. The impact is described as ...

SUSE CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

PT-2026-70359

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...

PT-2026-70208

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

PT-2026-70437

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70149

Name of the Vulnerable Software and Affected Versions Swing Music version 3.0.0 Description A missing authentication issue allows unauthenticated remote attackers to create arbitrary user accounts. This occurs because the 'POST /auth/profile/create' endpoint is allowlisted from JWT JSON Web Token...

PT-2026-70159

FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required ...