207940 matches found
CVE-2026-100351
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...
openssl: AES-OCB IV Ignored on EVP_Cipher() Path
A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface EVPCipher will have their provided Initialization Vector IV silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the...
EUVD-2026-102139
: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...
CVE-2026-45451
The Unitronics UniStream Pro and UniLogic systems are affected by an Improper Authentication vulnerability (CWE-287 ). Specifically, this issue impacts UniStream Pro versions B10 and C10 , as well as UniLogic versions prior to 1.41.329 . The vulnerability allows for unauthorized access with low p...
CVE-2026-45451 Unitronics - CWE-287: Improper Authentication
: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...
jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision
A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...
CVE-2026-110924
Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...
CVE-2026-110746 CVE-2026-110746
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM...
Microsoft Identity Web Elevation of Privilege Vulnerability
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network...
CVE-2026-110924
A vulnerability exists in OpenSSH when GSSAPI authentication is enabled. A failed GSSAPI authentication attempt can cause delegated credentials to remain stored for the connection, even if the user authorization fails. Consequently, a subsequent successful login on that same connection may be imp...
CVE-2026-110924
A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...
Information Exposure
Overview org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Information Exposure in the HttpClient. An attacker can obtain proxy authentication credentials by crafting a server that responds with a 407...
Authentication Bypass Using an Alternate Path or Channel
Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...
Authentication Bypass Using an Alternate Path or Channel
Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...
Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch releases of NPS and Callhome. Vulnerability Details CVEID:CVE-2026-1965 DESCRIPTION: libcurl can in some circumstances reuse the wrong connection when asked to do an...
Exploit for CVE-2026-18963
CVE-2026-18963 A proof of concept and vulnerability checker f...
CVE-2026-41940
CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...
CVE-2026-41940
CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...
PYSEC-2026-4247 PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
Call API localhost-only authentication bypass via spoofed Host header Summary PraisonAI's patched PRAISONAICALLAUTH=disabled safeguard for the n8n/call agent invocation API can be bypassed with a spoofed Host: 127.0.0.1 header, allowing an unauthenticated network caller to list and invoke...