PT-2026-117326

A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched...

ROS-20261019-73-0056

The vulnerability in Nomad is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Proxmox VE 8.0.3 Authentication Bypass

Proxmox VE versions 7.0 through 8.0.3 contain an authentication bypass in libpve-access-control. The supplied proof of concept submits an arbitrary tfa-challenge value to the access ticket API and reports issued authentication tickets. https://packetstorm.news/download/236347...

Apache Camel 4.22.0 Shiro Authentication Bypass

Apache Camel version 4.22.0 camel-shiro contains an authentication bypass when a thread-bound Shiro subject has the same principal as a later exchange, allowing its presented credentials to evade verification. This proof of concept demonstrates the issue. https://packetstorm.news/download/236339...

Marimo 0.20.4 Remote Code Execution

Marimo version 0.20.4 and earlier contains a missing authentication issue in the terminal WebSocket endpoint that can allow unauthenticated command execution. The submission provides documentation and Docker lab configurations for vulnerable and patched versions...

Cisco IOS XE Web UI Privilege Escalation

Cisco IOS XE Software Web UI contains an authentication bypass that allows unauthenticated remote attackers to execute a privilege level 15 command. This advisory summarizes affected releases, fixed releases, mitigations, indicators of compromise, and incident-response guidance...

PT-2026-117389

A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The...

PT-2026-117374

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Security for Kubernetes affected versions not specified Description An issue exists in the Central SAML authentication ACS endpoint where used SAML assertion or response identifiers are not retained to prevent replay...

PT-2026-117639

Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution...

PT-2026-117662

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...

PT-2026-117488

Name of the Vulnerable Software and Affected Versions WSO2 Identity Server affected versions not specified Description The authentication endpoint fails to provide a consistent system response when a username does not exist, allowing attackers to differentiate between valid and invalid usernames...

PT-2026-117493

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An unauthenticated user can execute workflow rules without authentication by sending a DWR request. This is achieved by setting isPasswordUppercase as one call...

PT-2026-117626

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...

PT-2026-117700

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication...

PT-2026-118026

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor 2FA bypass in github.com/0xJacky/Nginx-UI...

PT-2026-118033

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

PT-2026-118065

GitHub CLI partially discloses authentication tokens in gh auth status output in github.com/cli/cli...

PT-2026-118088

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable in github.com/0xJacky/Nginx-UI...

CVE-2026-82166: Missing Authentication for Critical Function

Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-112775: Improper Authentication

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...