PT-2026-116469

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

PT-2026-116200

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

CVE-2026-110653: Improper Authentication

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

SUSE CVE-2026-86413

When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...

SUSE CVE-2026-87861

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused...

SUSE CVE-2026-94265

When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...

CVE-2026-67234

A flaw was found in rabbitmq-server. When clearing authentication preferences, the server generates a non-compliant cookie name containing invalid characters that standard web browsers reject when attempting deletion. This issue prevents the browser from properly removing the cookie, allowing sta...

CVE-2026-67223

A flaw was found in rabbitmq-server. When the service uses the Lightweight Directory Access Protocol LDAP authentication plugin with a configured user Distinguished Name DN pattern, it fails to properly escape special characters in the username. A remote attacker can exploit this vulnerability by...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Really-Simple-Plugins Really_Simple_Security

InfoSec Audit & Reconnaissance Tools 🛡️🔍 !Python 3.10+htt...

[SECURITY] [DSA 6569-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6569-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 16, 2026 https://www.debian.org/security/faq -...

Exploit for CVE-2026-61979

🚀 CVE-2026-61979 - miniOrange SAML Single Sign On Authenticati...

Exploit for SQL Injection in Wordpress

🚀 CVE-2026-60137 - WordPress Core Critical SQL Injection SQLi...

CVE-2026-68573

Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin...

CVE-2026-108709

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended t...

EUVD-2026-103153

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended t...

CVE-2026-108709 Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended t...

CVE-2026-108709

A critical authentication bypass vulnerability exists within the in-house network of Apache Kylin , affecting versions 4.0.4 through 5.0.4 . The issue involves an unauthenticated metadata broadcast that primarily impacts services directly exposed to the public network, though most in-house deploy...

CVE-2026-68573 Apache Kylin: Unauthenticated Metastore Cleanup

Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin...

EUVD-2026-103148

Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin...

CVE-2026-68573

An Improper Authentication vulnerability in Apache Kylin (versions 4 through 5.0.4) allows an unauthenticated user to access system cleanup actions . This issue primarily impacts services directly exposed to the public network, though in-house deployments are generally less affected. The impact i...