Ivanti Endpoint Manager - Authentication Bypass

Ivanti Endpoint Manager 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges. id: CVE-2026-1603 info: name: Ivanti Endpoint Manager - Authentication Bypass author:...

Debian dsa-6569 : apache2 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6569 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6569-1 [email protected] https://www.debian.org/securit...

CVE-2026-111895: Improper Authentication

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111882: Improper Authentication

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

CVE-2026-111884: Use of Single-factor Authentication

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

PT-2026-116454

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.0-alpha through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description An authentication bypass exists that allows users authenticated via an Identity Provider IdP to skip Time-based One-Time Password TOTP...

Keycloak 26.7.3 Username Takeover

Keycloak versions through 26.7.3 contain an improper authentication flaw in the first-broker-login flow that allows a matching external-provider username to lock a legitimate user out of their account...

BMC Helix Network Management Authentication Bypass

BMC Helix Network Management versions before 26.3.01 contain an authentication bypass when SAML-based single sign-on is configured, allowing the local administrator account to authenticate with any password...

NoMachine Redis Improper Authentication Local Privilege Escalation

NoMachine contains an improper authentication vulnerability in its Redis component that allows local attackers to escalate privileges and execute arbitrary code in the service account context...

PT-2026-116481

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.0.0 through 4.1.8 Description An authentication bypass exists during the WebAuthn registration process. The registration endpoints allow credentials to be attached to any account without requiring a valid session or challen...

CVE-2026-111898: Improper Authentication

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

Linux Distros Unpatched Vulnerability : CVE-2026-109750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. CVE-2026-109750 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-102946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4,...

Linux Distros Unpatched Vulnerability : CVE-2026-104198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token...

CVE-2026-111911: Improper Authentication

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, th...

PT-2026-116475

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.0 through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description An insecure direct object reference exists in the 'GET /admin/api/user/data/userId' endpoint. The system returns the complete faquserdata row f...

PT-2026-116469

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

PT-2026-116200

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

CVE-2026-110653: Improper Authentication

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

SUSE CVE-2026-86413

When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...