CVE-2026-111617

WHartTest through 2.8.1 contains a missing authentication vulnerability in its UI-Automation WebSocket endpoints . Specifically, the UiAutomationConsumer accepts all connections, allowing unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ endpoints. An attacker can regis...

EUVD-2026-103039

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

CVE-2026-111617 WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

EUVD-2026-102953

Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network...

CVE-2026-80092

The Microsoft Identity Web component is affected by an authentication bypass vulnerability caused by assumed-immutable data . This flaw allows an authorized attacker to achieve privilege elevation over a network. The vulnerability is associated with CWE-302 . No specific exploit details or remedi...

CVE-2026-105667 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...

CVE-2026-105667

The J4Care dcm4che system contains a vulnerability where the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application in the default configuration. This lack of authentication allows a remote sender to reassign studies and related workflow records from on...

CVE-2026-105279 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identit...

CVE-2026-105279

The J4Care dcm4che archive is vulnerable to a missing authentication flaw (CWE-306) in its default configuration. The system incorrectly accepts DICOM associations from unregistered calling AEs, allowing a remote peer to perform unauthorized actions. Specifically, an attacker can use C-FIND and C...

Security update for glib2

This update for glib2 fixes the following issue: CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively y...

CVE-2026-41940

CVE-2026-41940 - cPanel/WHM Auth Bypass Scanner & Exploit Tool cPanel/WHM Authentication Bypass Scanner & Exploit Tool for CVE-2026-41940 ⚠️ Disclaimer This tool is provided for educational purposes and authorized security testing only. By using this tool, you agree that: You will only test system...

CVE-2026-64959

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...

EUVD-2026-102854

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...

CVE-2026-64959

Apache Kylin versions 5 through 5.0.4 are vulnerable to SQL Injection and Missing Authentication for Critical Function (CWE-89, CWE-306). The root cause is that certain backend cache API endpoints lack required authentication, allowing for the execution of injected SQL commands. This poses a high...

CVE-2026-64959 Apache Kylin: Missing authentication on certain cache API endpoints

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability...

CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support formerly Bomgar versions 26.2.3 and earlier. Patches are available for supported versions 24.3.1 and later; organizations using older versions must upgrade first. Cyber threat actor...

OESA-2026-4322 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Check for Certificate...

CVE-2026-19864

A flaw was found in Eclipse Jetty. The session authentication mechanism retains user credentials in session objects, which can cause plaintext passwords to be written to persistent storage when authenticated sessions are saved. An attacker with read access to the persistent session data store can...

WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Anatoly Gorbounov x1will in WordPress Plugin 2Way VideoCalls and Random Chat versions = 6.1.5...