CVE-2026-107350

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...

PT-2026-115276

Name of the Vulnerable Software and Affected Versions OpenHealth versions prior to 0.2.1 Description Missing authentication and authorization in the '/api/health-data/id' GET, PATCH, and DELETE handlers allow unauthenticated attackers to access medical records. By knowing a HealthData record id, ...

PT-2026-115274

Name of the Vulnerable Software and Affected Versions BMC Helix Network Management on-prem versions prior to 26.3.01 Description An authentication bypass exists when SAML single sign-on is configured. This allows unauthenticated attackers to log in as the local administrator by submitting the...

CVE-2026-104198: Improper Authentication

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

PT-2026-115216

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.34.0 through 1.36.38 Description The web interface mishandles failed token authentication in the web/includes/auth.php file. The validateToken function returns false when a token is malformed or has an invalid signature,...

CVE-2026-108334: Improper Neutralization of Special Elements used in an Expression Language Statement

A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...

PT-2026-115280

Name of the Vulnerable Software and Affected Versions Archon versions 0.2.13 through 0.11.1 Description Missing authentication allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agen...

CVE-2026-102946: Authentication Bypass by Spoofing

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

PT-2026-115112

Name of the Vulnerable Software and Affected Versions joserfc versions prior to 1.7.4 Description The deserialize json function in the joserfc.jws module incorrectly handles JWS General JSON Serialization when the signatures array is empty. The verify general json function fails to perform any...

CVE-2026-19863: Authentication Bypass Using an Alternate Path or Channel

An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within...

CVE-2026-111283: Authentication Bypass by Primary Weakness

BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an...

Linux Distros Unpatched Vulnerability : CVE-2026-55167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with...

CVE-2026-45451: Improper Authentication

: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

PT-2026-114982

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.144.0 through 0.146.0 Description An issue exists in the openapi3filter.ValidationHandler.Middleware where the security validation layer and the downstream request dispatcher may select different OpenAPI operations. The...

CVE-2026-77711

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

UBUNTU-CVE-2026-88834

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...

PT-2026-115071

Name of the Vulnerable Software and Affected Versions Nutanix Prism Element versions prior to 7.6.0.8 Nutanix Prism Element versions prior to 7.5.2 Nutanix Prism Element versions prior to 7.3.1.18 Nutanix Prism Central versions prior to 7.6.0.8 Nutanix Prism Central versions prior to 7.5.2 Nutani...

CVE-2026-102764: Authentication Bypass by Spoofing

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance...

CVE-2026-102764: Authentication Bypass by Spoofing

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance...

CVE-2026-110723: Authentication Bypass by Spoofing

In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy...